el7lwa.com Open in urlscan Pro
2606:4700:3031::6815:4dda Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://spotify-online.cleverapps.io/
Effective URL:
https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
Submission: On July 28 via api (July 28th 2023, 3:50:36 pm UTC) from US — Scanned from US

Summary HTTP 223 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 51 IPs in 4 countries across 41 domains to perform 223 HTTP transactions. The main IP is 2606:4700:3031::6815:4dda, located in United States and belongs to CLOUDFLARENET, US. The main domain is el7lwa.com. The Cisco Umbrella rank of the primary domain is 663439.
TLS certificate: Issued by E1 on June 5th 2023. Valid for: 3 months.

This is the only time el7lwa.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	185.42.117.192 185.42.117.192	43424 (MAGICRETAIL) (MAGICRETAIL)
1	139.45.197.238 139.45.197.238	9002 (RETN-AS) (RETN-AS)
16	172.64.167.17 172.64.167.17	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
15	2606:4700:303... 2606:4700:3031::6815:4dda	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:402... 2607:f8b0:4020:805::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20ee:9a00:6:b871:4f00:93a1	() ()
2	2600:9000:24e... 2600:9000:24eb:4e00:11:a4de:2580:93a1	() ()
1	2607:f8b0:402... 2607:f8b0:4020:806::2008	() ()
4	2607:f8b0:402... 2607:f8b0:4020:806::2003	() ()
1	2001:4860:480... 2001:4860:4802:34::178	() ()
14	2607:f8b0:402... 2607:f8b0:4020:805::2002	() ()
8	18.161.21.99 18.161.21.99	() ()
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	() ()
2	2a04:4e42:400... 2a04:4e42:400::485	() ()
5	2620:100:a001... 2620:100:a001::18	() ()
5	212.77.99.29 212.77.99.29	() ()
5	147.75.195.77 147.75.195.77	() ()
4	23.227.137.154 23.227.137.154	() ()
5	2606:4700:10:... 2606:4700:10::6816:2560	() ()
2 13	68.67.160.184 68.67.160.184	() ()
5	185.106.140.18 185.106.140.18	() ()
5	185.184.8.90 185.184.8.90	() ()
5	51.222.39.184 51.222.39.184	() ()
1	2a06:8640:454... 2a06:8640:454:0:e082:abff:fefe:d1d2	() ()
1	34.102.146.192 34.102.146.192	() ()
3	2620:100:a001::4 2620:100:a001::4	() ()
1	13.249.190.38 13.249.190.38	() ()
1	2600:9000:26d... 2600:9000:26dc:3e00:a:e047:753:be1	() ()
1	2606:4700:10:... 2606:4700:10::ac43:266a	() ()
1	34.96.70.87 34.96.70.87	() ()
1 2	34.120.135.53 34.120.135.53	() ()
2 4	2620:100:a001::c 2620:100:a001::c	() ()
1	34.206.201.46 34.206.201.46	() ()
1	141.95.33.111 141.95.33.111	() ()
2	74.119.119.139 74.119.119.139	() ()
13	2607:f8b0:402... 2607:f8b0:4020:806::2002	() ()
4	2607:f8b0:402... 2607:f8b0:4020:806::2001	() ()
2	35.190.39.111 35.190.39.111	() ()
3	35.244.159.8 35.244.159.8	() ()
33	2607:f8b0:402... 2607:f8b0:4020:807::2001	() ()
1	2600:1f18:4e9... 2600:1f18:4e9:5a01:b943:7cee:b004:871e	() ()
1 2	209.54.182.161 209.54.182.161	() ()
2 2	52.223.40.198 52.223.40.198	() ()
6 8	172.217.13.98 172.217.13.98	() ()
2 3	2607:f8b0:402... 2607:f8b0:4020:807::2004	() ()
3	2607:f8b0:402... 2607:f8b0:4020:807::2002	() ()
3 5	192.40.39.223 192.40.39.223	() ()
2	172.217.13.130 172.217.13.130	() ()
1	2607:f8b0:402... 2607:f8b0:4020:807::2006	() ()
223	51

1 185.42.117.192 (France)

ASN43424 (MAGICRETAIL, FR)

spotify-online.cleverapps.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.238 (United Kingdom)

ASN9002 (RETN-AS, GB)

grunoaph.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 172.64.167.17 (United States)

ASN13335 (CLOUDFLARENET, US)

jokekroako.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:4700:3031::6815:4dda (United States)

ASN13335 (CLOUDFLARENET, US)

el7lwa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:805::200a (Montreal, Canada)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20ee:9a00:6:b871:4f00:93a1 (None, )

ASN- ()

cmp.optad360.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:24eb:4e00:11:a4de:2580:93a1 (None, )

ASN- ()

get.optad360.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:806::2008 (None, )

ASN- ()

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4020:806::2003 (None, )

ASN- ()

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::178 (None, )

ASN- ()

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2607:f8b0:4020:805::2002 (None, )

ASN- ()

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.161.21.99 (None, )

ASN- ()

optad360.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (None, )

ASN- ()

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:400::485 (None, )

ASN- ()

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:100:a001::18 (None, )

ASN- ()

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 212.77.99.29 (None, )

ASN- ()

ssp.wp.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 147.75.195.77 (None, )

ASN- ()

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.227.137.154 (None, )

ASN- ()

ghb.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ghb1.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:10::6816:2560 (None, )

ASN- ()

useast.quantumdex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 68.67.160.184 (None, ) 2 redirects

ASN- ()

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.106.140.18 (None, )

ASN- ()

rtb.adxpremium.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.184.8.90 (None, )

ASN- ()

prebid-eu.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 51.222.39.184 (None, )

ASN- ()

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:8640:454:0:e082:abff:fefe:d1d2 (None, )

ASN- ()

ghb2.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (None, )

ASN- ()

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:100:a001::4 (None, )

ASN- ()

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.249.190.38 (None, )

ASN- ()

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26dc:3e00:a:e047:753:be1 (None, )

ASN- ()

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:266a (None, )

ASN- ()

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (None, )

ASN- ()

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.135.53 (None, ) 1 redirects

ASN- ()

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:100:a001::c (None, ) 2 redirects

ASN- ()

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.206.201.46 (None, )

ASN- ()

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.33.111 (None, )

ASN- ()

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.119.119.139 (None, )

ASN- ()

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2607:f8b0:4020:806::2002 (None, )

ASN- ()

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4020:806::2001 (None, )

ASN- ()

3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.39.111 (None, )

ASN- ()

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.159.8 (None, )

ASN- ()

google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2607:f8b0:4020:807::2001 (None, )

ASN- ()

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:4e9:5a01:b943:7cee:b004:871e (None, )

ASN- ()

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.54.182.161 (None, ) 1 redirects

ASN- ()

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.40.198 (None, ) 2 redirects

ASN- ()

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.13.98 (None, ) 6 redirects

ASN- ()

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4020:807::2004 (None, ) 2 redirects

ASN- ()

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4020:807::2002 (None, )

ASN- ()

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.40.39.223 (None, ) 3 redirects

ASN- ()

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.13.130 (None, )

ASN- ()

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:807::2006 (None, )

ASN- ()

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	googlesyndication.com pagead2.googlesyndication.com 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com tpc.googlesyndication.com	547 KB
24	doubleclick.net 6 redirects securepubads.g.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net	304 KB
16	jokekroako.com jokekroako.com — Cisco Umbrella Rank: 72364	67 KB
15	el7lwa.com el7lwa.com — Cisco Umbrella Rank: 663439	349 KB
13	adnxs.com 2 redirects ib.adnxs.com	9 KB
11	criteo.com 2 redirects bidder.criteo.com gum.criteo.com mug.criteo.com	17 KB
8	consensu.org optad360.mgr.consensu.org	23 KB
6	creativecdn.com prebid-eu.creativecdn.com invstatic101.creativecdn.com	2 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com	4 KB
5	openx.net 1 redirects oajs.openx.net google-bidout-d.openx.net us-u.openx.net	2 KB
5	onetag-sys.com onetag-sys.com	2 KB
5	adxpremium.services rtb.adxpremium.services	11 KB
5	quantumdex.io useast.quantumdex.io	916 B
5	adtelligent.com ghb.adtelligent.com ghb1.adtelligent.com ghb2.adtelligent.com	5 KB
5	a-mo.net prebid.a-mo.net	4 KB
5	wp.pl ssp.wp.pl	238 B
4	gstatic.com fonts.gstatic.com	77 KB
3	googletagservices.com www.googletagservices.com	169 KB
3	google.com 2 redirects www.google.com	1 KB
3	criteo.net static.criteo.net	72 KB
3	optad360.io cmp.optad360.io get.optad360.io	227 KB
3	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 11245 Failed	2 KB
2	adsrvr.org 2 redirects match.adsrvr.org	970 B
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com	2 KB
2	rtbhouse.com esp.rtbhouse.com	360 B
2	id5-sync.com cdn.id5-sync.com id5-sync.com	25 KB
2	crwdcntrl.net tags.crwdcntrl.net bcp.crwdcntrl.net	12 KB
2	jsdelivr.net cdn.jsdelivr.net	2 KB
2	gravatar.com secure.gravatar.com	2 KB
1	2mdn.net s0.2mdn.net	41 KB
1	yahoo.com pr-bh.ybp.yahoo.com	603 B
1	uidapi.com cdn.prod.uidapi.com	2 KB
1	openxcdn.net oa.openxcdn.net	8 KB
1	google-analytics.com www.google-analytics.com	250 B
1	googletagmanager.com www.googletagmanager.com	80 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 79	1 KB
1	t.co t.co — Cisco Umbrella Rank: 525	687 B
1	grunoaph.net grunoaph.net — Cisco Umbrella Rank: 140339	2 KB
1	cleverapps.io spotify-online.cleverapps.io	438 B
0	ampproject.org Failed cdn.ampproject.org Failed
0	smilewanted.com Failed prebid.smilewanted.com Failed
223	41

	Domain	Requested by
33	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com spotify-online.cleverapps.io 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com googleads.g.doubleclick.net el7lwa.com
16	jokekroako.com	grunoaph.net jokekroako.com
15	el7lwa.com	t.co el7lwa.com
13	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com pagead2.googlesyndication.com googleads.g.doubleclick.net
13	ib.adnxs.com	2 redirects get.optad360.io googleads.g.doubleclick.net
8	cm.g.doubleclick.net	6 redirects google-bidout-d.openx.net googleads.g.doubleclick.net
8	optad360.mgr.consensu.org	get.optad360.io
8	securepubads.g.doubleclick.net	get.optad360.io securepubads.g.doubleclick.net 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
6	googleads.g.doubleclick.net	3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com pagead2.googlesyndication.com
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
5	onetag-sys.com	get.optad360.io
5	prebid-eu.creativecdn.com	get.optad360.io
5	rtb.adxpremium.services	get.optad360.io
5	useast.quantumdex.io	get.optad360.io
5	prebid.a-mo.net	get.optad360.io
5	ssp.wp.pl	get.optad360.io
5	bidder.criteo.com	get.optad360.io
4	3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	gum.criteo.com	2 redirects static.criteo.net
4	fonts.gstatic.com	fonts.googleapis.com
3	www.googletagservices.com	3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
3	www.google.com	2 redirects tpc.googlesyndication.com
3	static.criteo.net	securepubads.g.doubleclick.net get.optad360.io static.criteo.net
3	my.rtmark.net	grunoaph.net jokekroako.com
2	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
2	us-u.openx.net	google-bidout-d.openx.net
2	match.adsrvr.org	2 redirects
2	s.amazon-adsystem.com	1 redirects google-bidout-d.openx.net
2	esp.rtbhouse.com	invstatic101.creativecdn.com
2	mug.criteo.com
2	oajs.openx.net	1 redirects
2	ghb1.adtelligent.com	get.optad360.io
2	ghb.adtelligent.com	get.optad360.io
2	cdn.jsdelivr.net	get.optad360.io securepubads.g.doubleclick.net
2	secure.gravatar.com	el7lwa.com
2	get.optad360.io	el7lwa.com get.optad360.io
1	s0.2mdn.net	3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
1	pr-bh.ybp.yahoo.com	google-bidout-d.openx.net
1	google-bidout-d.openx.net	oa.openxcdn.net
1	id5-sync.com	cdn.id5-sync.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	cdn.id5-sync.com	securepubads.g.doubleclick.net
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	ghb2.adtelligent.com	get.optad360.io
1	www.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	el7lwa.com
1	cmp.optad360.io	el7lwa.com
1	fonts.googleapis.com	el7lwa.com securepubads.g.doubleclick.net
1	t.co	jokekroako.com
1	grunoaph.net
1	spotify-online.cleverapps.io
0	cdn.ampproject.org Failed	securepubads.g.doubleclick.net
0	prebid.smilewanted.com Failed	get.optad360.io
223	56

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
plus.google.com
reddit.com
pinterest.com
betterstudio.com

Subject Issuer	Validity	Valid
*.cleverapps.io R3	`2023-05-26` - `2023-08-24`	3 months	crt.sh
grunoaph.net R3	`2023-07-17` - `2023-10-15`	3 months	crt.sh
jokekroako.com GTS CA 1P5	`2023-07-11` - `2023-10-09`	3 months	crt.sh
rtmark.net R3	`2023-07-25` - `2023-10-23`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2023-02-01` - `2024-02-01`	a year	crt.sh
el7lwa.com E1	`2023-06-05` - `2023-09-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.optad360.io Amazon RSA 2048 M02	`2023-03-01` - `2023-11-15`	9 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
optad360.mgr.consensu.org Amazon RSA 2048 M02	`2023-04-23` - `2024-05-21`	a year	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-23` - `2024-01-24`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-19` - `2023-10-18`	3 months	crt.sh
*.wp.pl RapidSSL TLS RSA CA G1	`2023-03-09` - `2024-03-14`	a year	crt.sh
*.a-mo.net R3	`2023-07-04` - `2023-10-02`	3 months	crt.sh
ghb.adtelligent.com ZeroSSL ECC Domain Secure Site CA	`2023-06-01` - `2023-08-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-04` - `2024-05-03`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.adxpremium.services Sectigo RSA Domain Validation Secure Server CA	`2022-08-26` - `2023-08-05`	a year	crt.sh
*.creativecdn.com RapidSSL TLS RSA CA G1	`2023-03-29` - `2024-04-28`	a year	crt.sh
*.onetag-sys.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-28` - `2024-01-28`	a year	crt.sh
ghb1.adtelligent.com ZeroSSL ECC Domain Secure Site CA	`2023-06-04` - `2023-09-02`	3 months	crt.sh
ghb2.adtelligent.com ZeroSSL ECC Domain Secure Site CA	`2023-06-04` - `2023-09-02`	3 months	crt.sh
oa.openxcdn.net GTS CA 1D4	`2023-07-27` - `2023-10-25`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-27` - `2023-08-27`	3 months	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M01	`2022-11-07` - `2023-12-06`	a year	crt.sh
cdn.prod.uidapi.com R3	`2023-05-18` - `2023-08-16`	3 months	crt.sh
invstatic101.creativecdn.com GTS CA 1D4	`2023-06-27` - `2023-09-25`	3 months	crt.sh
*.id5-sync.com R3	`2023-07-04` - `2023-10-02`	3 months	crt.sh
esp.rtbhouse.com GTS CA 1D4	`2023-07-14` - `2023-10-12`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-04-04` - `2023-09-27`	6 months	crt.sh
www.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh

This page contains 17 frames:

Primary Page: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
Frame ID: BED791716D8D3FAC2A0C4FB1CCF5CE5A
Requests: 140 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=el7lwa.com
Frame ID: 47A529E8966F3A64622054E473762BDC
Requests: 2 HTTP requests in this frame

Frame: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: B8205301D05F8920448B283115FE501B
Requests: 1 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 36504A959E6FF2B2713857904FAB7F9A
Requests: 6 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=el7lwa.com
Frame ID: 9B0EF9BE7CD421D7F775307A42AF510F
Requests: 2 HTTP requests in this frame

Frame: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: BA15EDC8402BFAF3FB4B61299E1F0BD3
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 06292AAA070B2897016B92F096213FD7
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0CF5D27D7336E02904F6389F5799C7A6
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html
Frame ID: CBA9D799EA13EE22E0678538D3AE3DF6
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: E09EACE2FB6F899882ADB37EA810C38B
Requests: 2 HTTP requests in this frame

Frame: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 09DCC27227FDCCFD83929BBE45FCD7F6
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhC9m-bYAhj5joDxATAB&v=APEucNX42Ajo3RC8QYSjDHjhHKF-pTL1tW6KIrq1Fa2ZNrPMHZDIkLDdvR2ML9KrGbW2RcJkt5njTWpOs1-jUstr7YkoiTdSgg
Frame ID: FDC043B29A769784E1B91D9C76736252
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 145482F2169F441828E20F9D11E3C457
Requests: 2 HTTP requests in this frame

Frame: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D78B3B996174C1BB9BF7BBB0937BB08F
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html
Frame ID: 47A37ACEEC557A2B539C92001276755A
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: D02C3AD782B200978D1F57A1A169BC5A
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012307180709000/amp4ads-v0.mjs
Frame ID: 716A96ED6E5D8C72D970C25A4828D572
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

TOP 10 DEGREES IN DEMAND FOR 2021 – Online degrees

Page URL History Show full URLs

https://spotify-online.cleverapps.io/ Page URL
https://grunoaph.net/partitial/5117834/?var=5769941 Page URL
https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z... Page URL
https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z... Page URL
https://t.co/FVFSLGVXVX?amp=1&oaid=6ff1b16238f7a9758d671ed24bbfb829 Page URL
https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

223
Requests

88 %
HTTPS

47 %
IPv6

41
Domains

56
Subdomains

51
IPs

4
Countries

2066 kB
Transfer

5758 kB
Size

25
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=TOP%2010%20DEGREES%20IN%20DEMAND%20FOR%202021&url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&title=TOP%2010%20DEGREES%20IN%20DEMAND%20FOR%202021

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&media=https://el7lwa.com/degree/wp-content/uploads/2021/04/images-44.jpeg&description=TOP%2010%20DEGREES%20IN%20DEMAND%20FOR%202021

Search URL Search Domain Scan URL

URL: http://betterstudio.com/
Title: BetterStudio

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://spotify-online.cleverapps.io/ Page URL
https://grunoaph.net/partitial/5117834/?var=5769941 Page URL
https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb Page URL
https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2 Page URL
https://t.co/FVFSLGVXVX?amp=1&oaid=6ff1b16238f7a9758d671ed24bbfb829 Page URL
https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 111

https://oajs.openx.net/esp?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&rid=esp&cc=1

Request Chain 115

https://gum.criteo.com/sid/json?origin=publishertagids&domain=el7lwa.com&sn=ChromeSyncframe&so=0&topUrl=el7lwa.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=lc_S4Xx6MldCTW9GU3hVM3ZacU05SVBmTFZ6Kys2ZmtkZFVaSUY3Ylk3VnJacGgvRWE4bWtXbTRIQVJYY1RMY2RRVXF0ck9icVdqN2hkTHVockhuYzVuUkhKVFdmaDBVZGJHRlE1Q1FuTE4vT1hiY3hWZEtmeURzZVUvbGhnVzdoSWVMT21wTFFLd1g5QkdDbzQ5bEpoTVRRdmwvWTVIeWpoVEFhNUF6Y2xQMW9lQkdpOXlLOEVka0tSOXNiUHdkZjBOQXZnVTV4a2NVeGF0RDlHclFFb2lud1dwMVFPdzJRZEtlbFFCMWl3Ny96Q3R4ZUFhM1pmRjhXYzNxYUJYOFNXaHM5MU90OVUzNFppaVJaUDZJV2lxeUg3UT09fA&cppv=2

Request Chain 141

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=da4a5ef0-2882-c35d-09fb-797b978bd35e HTTP 302
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=da4a5ef0-2882-c35d-09fb-797b978bd35e&dcc=t

Request Chain 142

https://match.adsrvr.org/track/cmf/openx?oxid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=876fe874-f014-4772-90fd-ff394036b1ac&ttd_puid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0&gdpr_consent=

Request Chain 143

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWVmM2YxNDctZmQ1Zi0yNjAzLWRjMTUtYTE1NTM1NWFkNmRl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWVmM2YxNDctZmQ1Zi0yNjAzLWRjMTUtYTE1NTM1NWFkNmRl&google_tc=

Request Chain 144

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEkMS5EqDH7dNv6riYYxO8Q&google_cver=1

Request Chain 148

https://gum.criteo.com/sid/json?origin=publishertag&domain=el7lwa.com&sn=ChromeSyncframe&so=3&topUrl=el7lwa.com&bundle=fg90JF9LaXF5QmglMkZBbE9MVFdyNXlDeTRXOVVkOTNYZmVNWFBaRGxpdXAlMkZkWCUyQkl3ODl6dzhaWnBndkNHbTF0elYlMkIlMkIyaUxqSTVKMUxTOXYlMkZxVEhsb2lXbllGR2dLdkclMkZDeHVJcWNyUTA3UzQwb3clMkYlMkI3dU5PdWZoUUxIdU05Vmtab1pha0VMWnJsbmNDRG1OZ2haWW5zVngxTEElM0QlM0Q&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=gdbT23wxQ3IzRkFuTmRXdWphQjQ3NlZXcDZ2enpqZVpyRXk4OHJMeVVCeWJveXJBNEg5dmNrWjhzS0VnaG1YaEt5VG5CVFRMYnltRnBZTE9aL05rMS9QTktmR25zVmVQNGtWNHlVQ0NyZ01OM3M2MTdxbCttS0tGYnE5QVZ1MEdBeFVQS2FsWHhxSm9QcDVXWGwrT2luRnhieUgvekpFNlJOdVV3NXZwNytBSWdsS2h0QS91QzRlK2MrUGVvc3M4NGFuYnFGeXJJU3ZtT1VENDV6K1A4MVRaKzdJSUNicTl6K2xiS3AxNWlMR3c5Z2FEeW84YUI5eUw2Tk5DSUxZak92U2NYMWl1L1BMd0dXcGUrSlZmRXNmLzNYdUdIRTJSQ2k5UEpIbURuQmZRY1Q1bz18&cppv=2

Request Chain 161

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 186

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1&C=1

Request Chain 187

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZMPjyD-p5y5wi33PHb6MTAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1

Request Chain 188

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFh5F7zLJVVwnrXykqpYEIs&google_cver=1

Request Chain 189

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTc2ODQ1NzY5NDY4MTUxNzM2MA%3D%3D

Request Chain 211

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

223 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
spotify-online.cleverapps.io/ 124 B
438 B 531ms
87ms Document
text/html 185.42.117.192
MAGICRETAIL

General

Check archive.org

Show headers Download Go to

Full URL: https://spotify-online.cleverapps.io/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.42.117.192 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software: Apache /
Resource Hash: 8c3bf17f943508b7d6ea95e60395c283f94cc61c2113df2721a4892b22affe75

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 137
Content-Type: text/html
Date: Fri, 28 Jul 2023 15:50:25 GMT
ETag: "7c-6014510c9d519-gzip"
Last-Modified: Tue, 25 Jul 2023 00:46:46 GMT
Server: Apache
Sozu-Id: 01H6EK3AX30FJ6QMV18JMA614P
Vary: Accept-Encoding

GET
H2 200 /
grunoaph.net/partitial/5117834/ 1 KB
2 KB 364ms
82ms Document
text/html 139.45.197.238
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://grunoaph.net/partitial/5117834/?var=5769941
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.45.197.238 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://spotify-online.cleverapps.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: * *
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0 no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf8
date: Fri, 28 Jul 2023 15:50:26 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT Mon, 26 Jul 1997 05:00:00 GMT
link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch" <https://jokekroako.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://me9qgidaa.com>; rel="preconnect dns-prefetch"
pragma: no-cache no-cache
server: nginx
timing-allow-origin: *
x-trace-id: 739be7c3576f2b0a4f98d8e9d843eadb

POST img.gif
my.rtmark.net/ 0
0

GET
H2 200 /
jokekroako.com/ 38 KB
13 KB 178ms
134ms Document
text/html 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Requested by: Host: grunoaph.net
URL: https://grunoaph.net/partitial/5117834/?var=5769941
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7ede471df8b80f7b-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 28 Jul 2023 15:50:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B047xmlZITLwE%2BpjQilxkPwySDuUDIBzQSZo25Cz87feVeFVVDb1dB9K1sw2Na1lvCLxWzGk2CsJFEKXFXaB9If12%2FMXOvY9ips6lnYxRhWmPuA0KWxDZMLjf%2BWKl5EoKw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

GET
H2 200 gid.js
my.rtmark.net/ 65 B
543 B 96ms
95ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?userId=6ff1b16238f7a9758d671ed24bbfb829

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:26 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://jokekroako.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H2 200 micro.tag.min.js
jokekroako.com/pfe/current/ 41 KB
14 KB 140ms
85ms Script
application/javascript 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1
Requested by: Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:26 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 11 Jul 2023 14:26:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64ad6687-a507"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=llfYQhUOfDJoCfhwCng%2FGM2N0kGNECStftpJZILjCgNdU0%2Fg8FnZoz6pvSsm53sKcrDZDD%2Fz35GITMeASgIeLh9m2Awo2Z%2F7C3ViBkcTqXgKyJN1Qiz8cy0NeuuagzziUw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 7ede47200a9f0f7b-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 /
jokekroako.com/19/4662728/ 3 KB
2 KB 242ms
197ms XHR
application/json 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/19/4662728/?abt_opts=1&var=5117834&var3=708820209196340131&ymid=&rhd=1

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:26 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: f71269f3f53ff4e14993b9afbbd4f748
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qJ6lyEw39eYw4AcWWI%2FAEgTUubGflGerS18V%2BcrdWfyOHNmfnoWFUMfLQFu1aagGAmRchD2DmsoKCUeRJFjvEpQRaKEuyQXWKbLftkLQE9CDtKwkECZ%2FodysTV%2FiHgVGWw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://me9qgidaa.com>; rel="preconnect dns-prefetch"
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7ede47200a9c0f7b-EWR
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
DATA 200
OK truncated
/ 327 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 200 /
jokekroako.com/ 2 B
391 B 108ms
86ms XHR
application/json 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&mprtr=1
Requested by: Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:26 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HzN%2Fq0mIZmZ6by%2B2ryloDd6e5G8l9BiVP1Tsmr%2FkyQv9hals%2B3jK1shu1pQhK%2F04lLWUPoRCIHFIXsjsQBUbXX3ctrLKAolTpQBlocp9wXlVrud0eO%2BX13Jn1%2FHqZH1dVA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 7ede47200a9b0f7b-EWR
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 200 4662709
jokekroako.com/sw-check-permissions/ 0
985 B 103ms
102ms Other
application/javascript 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/sw-check-permissions/4662709?var=5117834&ymid=708820209196340131&uhd=1
Requested by: Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:26 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sXy4N5MqwKls9FVug6TnAwNytaTdv%2BPpil%2FB21oC4rwLsZjSjsmfmFegACuSjJgM94oVXVw3Tw1soE%2BwHPOayvO%2B9C07ft%2BvRlZpFTkODpxsy8Jhl4Q3dEsWSIImrjtttw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray: 7ede4720bdd54301-EWR
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400

POST
H3 200 zone
jokekroako.com/ 0
490 B 198ms
196ms Ping
text/plain 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=jokekroako.com&var=5117834&ymid=708820209196340131&var_3=&var_4=&dsig=&action=prerequest

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-trace-id: e9b477ce239ee2e300f51a05c3b40400
date: Fri, 28 Jul 2023 15:50:26 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2Frum5V%2FCm1ciEHnO0HNyTlgufc%2FR16VT0jiurSX80FaXwS5qAjWdMCCnNQs8mpYnB%2B%2FzTcXh%2BMWJGlDa%2BtyWfLx%2ByEw3H1V4DbhkAZHiXIz8yAhGx%2BhgfvbGVq963ry1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://jokekroako.com
access-control-allow-credentials: true
cf-ray: 7ede4720bdd44301-EWR
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 gid.js
my.rtmark.net/ 65 B
543 B 84ms
79ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=708820209196340131&var=5117834

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:26 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://jokekroako.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H3 200 zone
jokekroako.com/ 904 B
1 KB 172ms
170ms Fetch
application/json 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=jokekroako.com&var=5117834&ymid=708820209196340131&var_3=&var_4=&dsig=&action=settings

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:26 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-trace-id: 155ea574e16b57a6012ce1582d3b2013
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H2MCAhaFQ2Ff2%2BiPtm4y0wOyUXrRvrgfwsisfqwFy7EUwD4aJZmyHw6HVmJyaOsNu5h7ywSTSMxDLWlt51bTwiD7VwebE4MFCujDyie7xxR8KgKTkqCkqY7ltBtXSlhxng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7ede47215e654301-EWR
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H3 200 / Show response
jokekroako.com/ 38 KB
13 KB 144ms
144ms Document
text/html 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
Requested by: Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 1d52889bf70782f23e5b1c22cb1bd2f60a044bf9aaa979733ddfeaa43d761273

Request headers

Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7ede47220f244301-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 28 Jul 2023 15:50:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oZMlDU%2BxTAW1hYEfoz65DjnwqgpHEn%2Fu2kYMNcVE7Crl2VDZAK4kYlhDikrHC60DdSc0HGOfM2ggzNbj%2BLrMFcsf8I0n7oWRoipLLJjDjd8zIPQ0kCBpsKvnkVTHLE5dew%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

GET
H3 200 micro.tag.min.js Show response
jokekroako.com/pfe/current/ 41 KB
14 KB 94ms
93ms Script
application/javascript 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1
Requested by: Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa6566c193a0f52c4341498a1c39613f0c040df3100d1ddb68ff95b45f7d0616

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:27 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 11 Jul 2023 14:26:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64ad6687-a507"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZoEPHQl%2B78KScMMkplGeiUsMvwm8ObXii9SrYgiOuS%2BjTB0Aa8GqsNyWxOytmX20qsQkieBOme5Q3Jnl%2BK%2BKzjfDlSpwrAksuv9DNe6il%2BsOfxe72L8wz8%2FBNQgPvqBasg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 7ede47258acf4301-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 / Show response
jokekroako.com/19/4662728/ 3 KB
2 KB 100ms
100ms XHR
application/json 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/19/4662728/?abt_opts=1&var=5117834&var3=708820209196340131&ymid=&rhd=1

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f6ab3365e9b4257d5fc5e14b7fb19a2a6eb287db89e6f573bd881bccfa59052

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:27 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: ffc33a09520268a17a5a5bffed80379f
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Q%2Fz7W1T45YTvNDfvaep59m2LgRDgRIPcyZe8lu3khLp%2BfhMxjPP3XpCePxUdwL01CQzqdhOM%2B326oeUVRZ1xCnMf%2F6b8ZUJpro1jSS8CAVI7tDoBz4AZFX058hmhKBK1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://me9qgidaa.com>; rel="preconnect dns-prefetch"
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7ede47258ad34301-EWR
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
DATA 200
OK truncated
/ 327 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3 200 / Show response
jokekroako.com/ 2 B
530 B 113ms
112ms XHR
application/json 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2&mprtr=1
Requested by: Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:27 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dyutbJwU2sXhqopLDR6gxaKaW3Rp0GKNp1zk%2BUtXU878LnyxpGhcxqtnh8YVMVVSulp%2FRpqBiQNbnxsU%2BA5SrujokNV3QhMBdYx9Ox4%2BSfhg6zpcT8YOAJyoyShLCxjojQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 7ede47259ae74301-EWR
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 200 4662709
jokekroako.com/sw-check-permissions/ 0
950 B 99ms
99ms Other
application/javascript 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jokekroako.com/sw-check-permissions/4662709?var=5117834&ymid=708820209196340131&uhd=1
Requested by: Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:27 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rWAhIHIX5OF5PCADXggzr0vgky5oKiIRqNp9a%2BJ2dFqg8%2BgXhSRvqUGJom5lQMte%2B8oUTr1%2B4PX29I%2BtxHv1ukDLIOKbzCsscsCEQCOOrkogYIFy0kqAxdjRTCakNsAK5w%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cf-ray: 7ede47263b7f4301-EWR
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
alt-svc: h3=":443"; ma=86400

POST
H3 200 zone
jokekroako.com/ 0
481 B 97ms
97ms Ping
text/plain 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=jokekroako.com&var=5117834&ymid=708820209196340131&var_3=&var_4=&dsig=&action=prerequest

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-trace-id: b7286381e21433d24d465102da82f6fb
date: Fri, 28 Jul 2023 15:50:27 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bI24Rb1LNN2S4k52aYrjUULOxKyxJXA%2FQ8VTeyCW1c4Niu3QndqQxsygnfbEMq2OJZQb6A0owXznV5hNKeP60hze1jODRXYaChkibRlXWfgNNMDK3kt%2FjKqkd9bLxPfLrA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://jokekroako.com
access-control-allow-credentials: true
cf-ray: 7ede47263b794301-EWR
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H3 200 rhd
jokekroako.com/ 2 KB
3 KB 196ms
196ms Fetch
application/json 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/rhd?rb=ca2fLfSN1n_9MrHBnuQDICFyVgxQS7KSWMxwf2AFox2Qr-lorF2pFNV0nm5eL37ynGEQ8gmTycJQ9O-IF5EtxDk9fIHRVmAHaWZ5vj7cR-vYisElDIo1n-Ho06giUnU6CdVPvlCYB2HTZxBx3YJO__HL9Dx_yYQSjUvm4qGBBxPkHUkrWZOGN84JO7XDBD5h7iwTONBiZYu7zvqfjCEKt1XTim2ttg3GMhHSkudndca-LsfpLmE656s3Fp9--sKW2OCwHhLCWYqgZiKKHW6ArooeqlD9TNNJdiDrXtY1QxtQ5Gzv46bK8s4iBq5eA0TFpK0UqnDupuT0ldNFAcixoC2D-h1dWmY8LiXPKJ59w7pAjWqEA-AuA4nW_o25AduzXgkpts3-TWAnArQh1xWqe4vsYkqOzZdYFKNT4UAq68MRBk3UyPa-Jm1wjLUJ3P9z250yDmfu6fXZgu4WTj3ZO5riQ9t5A0nsGk3hUqQoORf6maxP&request_ab2=0&zoneid=4662728&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wih=1200&wiw=1600&wfc=0&pl=https%3A%2F%2Fjokekroako.com%2F%3Fs%3D708820209196340131%26ssk%3D25bdf79c9b514d8dcdec1ebf78962986%26svar%3D1690559426%26z%3D5117834%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb%26rdc%3D2&drf=https%3A%2F%2Fjokekroako.com%2F%3Fs%3D708820209196340131%26ssk%3D25bdf79c9b514d8dcdec1ebf78962986%26svar%3D1690559426%26z%3D5117834%26pz%3D4662709%26tb%3D4662728%26l%3DWGYVPKNMPvY53zb&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-unknown&var=5117834&var3=708820209196340131&ymid=&rhd=1&m=link

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:27 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-trace-id: 86b6aa73093c0684342dabe18367eb44
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SudaEZAWg%2FePG5Jynv14FuQFcpVDthhlVXnlqG18eqah%2FWWkCwg74GHwWJVPO%2FkN2Kd%2B9UHvJ6CzGIsITcuaDRF74X8%2BrrPNJvRygAQ4bdDi%2BIEl37jSE8%2Baul2YWMhNuA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7ede47266bac4301-EWR
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 200 gid.js
my.rtmark.net/ 65 B
543 B 98ms
98ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=4662709&checkDuplicate=true&ymid=708820209196340131&var=5117834

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:27 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://jokekroako.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H3 200 zone
jokekroako.com/ 904 B
1 KB 166ms
166ms Fetch
application/json 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/zone?&pub=0&zone_id=4662709&is_mobile=false&domain=jokekroako.com&var=5117834&ymid=708820209196340131&var_3=&var_4=&dsig=&action=settings

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/pfe/current/micro.tag.min.js?z=4662709&ymid=708820209196340131&var=5117834&sw=/sw-check-permissions/4662709&uhd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:27 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-trace-id: 385caae6952802fba37e8250859b472b
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kac2FrUHtoHfj5WdlL1F4efMxthMVIZX0GYvT3DpDnQfLKQ1eoS6j6duRIH3Z%2BARUZ4HFnibd%2FUncy2GGyFD4F1Q6QhuYyWMgZi2yKYWZBl%2F7LaGDEyai4sZ6YqZKhP2JQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7ede47268bd44301-EWR
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 FVFSLGVXVX
t.co/ 337 B
687 B 176ms
41ms Document
text/html 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/FVFSLGVXVX?amp=1&oaid=6ff1b16238f7a9758d671ed24bbfb829

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 206
content-type: text/html; charset=utf-8
date: Fri, 28 Jul 2023 15:50:27 GMT
expires: Fri, 28 Jul 2023 15:55:28 GMT
perf: 7626143928
server: tsa_b
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 1da433215212ec8323bf152297cd1d859307c7449f62f25c13c3fc40089fd9dc
x-response-time: 12
x-transaction-id: 5e7aebf7bcfca74c
x-xss-protection: 0

POST
H3 200 cat.php
jokekroako.com/ 0
761 B 98ms
97ms Ping
text/plain 172.64.167.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jokekroako.com/cat.php?userId=6ff1b16238f7a9758d671ed24bbfb829&zoneid=4662728&rb=ca2fLfSN1n_9MrHBnuQDICFyVgxQS7KSWMxwf2AFox2Qr-lorF2pFNV0nm5eL37ynGEQ8gmTycJQ9O-IF5EtxDk9fIHRVmAHaWZ5vj7cR-vYisElDIo1n-Ho06giUnU6CdVPvlCYB2HTZxBx3YJO__HL9Dx_yYQSjUvm4qGBBxPkHUkrWZOGN84JO7XDBD5h7iwTONBiZYu7zvqfjCEKt1XTim2ttg3GMhHSkudndca-LsfpLmE656s3Fp9--sKW2OCwHhLCWYqgZiKKHW6ArooeqlD9TNNJdiDrXtY1QxtQ5Gzv46bK8s4iBq5eA0TFpK0UqnDupuT0ldNFAcixoC2D-h1dWmY8LiXPKJ59w7pAjWqEA-AuA4nW_o25AduzXgkpts3-TWAnArQh1xWqe4vsYkqOzZdYFKNT4UAq68MRBk3UyPa-Jm1wjLUJ3P9z250yDmfu6fXZgu4WTj3ZO5riQ9t5A0nsGk3hUqQoORf6maxP&var=5117834&var3=708820209196340131&ymid=&rhd=1

Requested by

Host: jokekroako.com
URL: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.167.17 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://jokekroako.com/?s=708820209196340131&ssk=25bdf79c9b514d8dcdec1ebf78962986&svar=1690559426&z=5117834&pz=4662709&tb=4662728&l=WGYVPKNMPvY53zb&rdc=2
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 0
x-trace-id: 9a3aa6b9ab644b0dbd5be42dbe0065fc
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZJryES8jm4ynU6%2FcN%2B%2BVOe5NpKWNbLfcQL29%2BxWh8PuxG7plykCVydKAFmNkwHoCxHY%2FIqwWTCBK1Z2P1vyEj73fXdZlHVqh3n0OHgOaANieaRyMY5oGAAkw53qfDWDq%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://jokekroako.com
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
cf-ray: 7ede472a6ffe4301-EWR
expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 200 Primary Request / Show response
el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ 66 KB
17 KB 447ms
392ms Document
text/html 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
Requested by: Host: t.co
URL: https://t.co/FVFSLGVXVX?amp=1&oaid=6ff1b16238f7a9758d671ed24bbfb829
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.14
Resource Hash: 8fe55260ff38a5b43c17e07465097fa5821d6376241ac60f22411b3d36579653

Request headers

Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=7776000
cf-cache-status: DYNAMIC
cf-ray: 7ede472bf9bd19f3-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 28 Jul 2023 15:50:28 GMT
expires: Thu, 26 Oct 2023 15:50:28 GMT
link: <https://el7lwa.com/degree/wp-json/>; rel="https://api.w.org/", <https://el7lwa.com/degree/wp-json/wp/v2/posts/11>; rel="alternate"; type="application/json", <https://el7lwa.com/degree/?p=11>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t7t5hxKJsLlQnzrsoBj%2FxZuPdFxGHrNLf%2BvZWvhYr7HfgSeSp4%2BbRjztSbVORFI7zYuEhi%2Fi9HT4CjCie3Vw24yTzfvzSlIJtjKksn8JVDxdH9tKPrbkImkJlAnkTDlpKZeCEfo7fZdF"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding,User-Agent
x-pingback: https://el7lwa.com/degree/xmlrpc.php
x-powered-by: PHP/7.4.14

GET
H2 200 style.min.css
el7lwa.com/degree/wp-includes/css/dist/block-library/ 95 KB
13 KB 31ms
19ms Stylesheet
text/css 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566924
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Thu, 30 Mar 2023 02:09:57 GMT
server: cloudflare
etag: W/"6424ef75-17ced"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yaye%2BYEK434KfimXX3JnBDjrWqCXqtltlTN2jk2irsat5dlIv1Nn1IotomtwWE3fCIBop0iQXxG5KiiY%2FdR%2Fpyt3BpDz7i7vSIiBYf8UULXDWoZwtHnnyn%2FqHEDlc%2Bpi9584Dxt%2Fj0fb"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 7ede472e8b9319f3-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 classic-themes.min.css
el7lwa.com/degree/wp-includes/css/ 291 B
638 B 22ms
11ms Stylesheet
text/css 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-includes/css/classic-themes.min.css?ver=6.2.2

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566924
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Thu, 30 Mar 2023 02:09:57 GMT
server: cloudflare
etag: W/"6424ef75-123"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MWJv53Jiu5Ac5Gd3I96u5syVL0sJvODIHT5Na82k0vWk9cVIzrd1O7itGXu%2BiC8iy1PNB%2BuTljhmdI6y2A41mWcBMJwy7RD1ekStx6f77s0Ge4GpD%2B0F9ZCA34aFvSO0DhslO90fDDrx"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 7ede472e8b9419f3-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 147ms
33ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700%7CRoboto:400,500,400italic&display=swap

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

95785ffb91b3577eabc72dc0dd0f79029c7a822c6edd16d495a57c3e94b3cd20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 28 Jul 2023 15:41:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 28 Jul 2023 15:50:29 GMT

GET
H2 200 jquery.min.js Show response
el7lwa.com/degree/wp-includes/js/jquery/ 88 KB
32 KB 40ms
30ms Script
application/javascript 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-includes/js/jquery/jquery.min.js?ver=3.6.4

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566924
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Thu, 30 Mar 2023 02:09:57 GMT
server: cloudflare
etag: W/"6424ef75-15ed7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PIx146WNdzjBiMV0LB%2BbwiPLDVm2XYbKDEFeXiLwamfMQmDC2s4ZyPHZQWbY6%2FYV5XFRGCgvDKi6D8BUpsrAoz73u3VSGdEP74EmZ%2BH1abLzW5zdTDJzkGZqKLK%2BFSLOZixMGu5ujS21"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 7ede472e8b9719f3-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-migrate.min.js Show response
el7lwa.com/degree/wp-includes/js/jquery/ 13 KB
5 KB 24ms
14ms Script
application/javascript 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://el7lwa.com/degree/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.0
Requested by: Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 30 Mar 2023 02:09:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1502647
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TnmGyBvyp2y2bLOpHbJ87rDG3%2BHICCuNwyXGeJ7Ga79HYkKt2pIK8Zhgl4dnDnz2jZoApF3ceAIUWrHY4bICx%2Fv%2BcQ634jDCprsudHaaYLphJ1PM4whIf%2BOC%2FOOa2uqGdS9TdzauYdQM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=7776000
cf-ray: 7ede472e8b9819f3-EWR
alt-svc: h3=":443"; ma=86400
expires: Mon, 09 Oct 2023 06:26:21 GMT

GET
H2 200 713d65cd673abe5a6a9d3458fc8ffe97.css
el7lwa.com/degree/wp-content/bs-booster-cache/ 702 KB
100 KB 32ms
22ms Stylesheet
text/css 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-content/bs-booster-cache/713d65cd673abe5a6a9d3458fc8ffe97.css

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99e4b842bdd8f0f126d8433a53858582506ca16e58c23cb7669bb03607a3049f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566924
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Apr 2021 17:31:16 GMT
server: cloudflare
etag: W/"6075d564-af689"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JjG5wiEArzXloYiaVjynD%2FaG32DKFZXmoTtLURaN9QbAw%2FHvUqCsvqRZrsukgUne0TMNNm2NbLmu1fL0i%2FDwedC0E5iJ9s6V3kQpNRUqBR5byOuz0c%2FawVW7H0UO3k8kfJAyE8FHE4Mn"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 7ede472e8b9519f3-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 35a041324bbe555cb580784c8ce2b9ad.css
el7lwa.com/degree/wp-content/bs-booster-cache/ 40 KB
6 KB 22ms
13ms Stylesheet
text/css 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-content/bs-booster-cache/35a041324bbe555cb580784c8ce2b9ad.css

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fe6c670986cf69f0a5db5bdb7f2d2cbca3a548339dcb820597f924f048d658e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566924
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Wed, 16 Jun 2021 16:45:06 GMT
server: cloudflare
etag: W/"60ca2a92-9ea0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G%2B%2BfWoVeQ8KEPWPLmBksoUhAwd9KvITRojTXfc1RdBw663QfL9naVvz4kO3uyn6UyS7M8WYoYvtVKc1HKJSErKRNYgK893y%2BGwszZN7MH1IsqZgRh%2BclzvEnGBFE%2B2X8vojbWSt5B%2F3t"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 7ede472e8b9619f3-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 eaa2a42b-30d5-4573-aa66-b32ea93e3400.min.js Show response
cmp.optad360.io/items/ 497 B
852 B 103ms
17ms Script
application/javascript 2600:9000:20ee:9a00:6:b871:4f00:93a1

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.optad360.io/items/eaa2a42b-30d5-4573-aa66-b32ea93e3400.min.js
Requested by: Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ee:9a00:6:b871:4f00:93a1 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bd7680f0d4768bf17b38b5834d7671e6e456d9655b4ae3cb39186d1fcd93f5c2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 06:47:56 GMT
via: 1.1 1c4cb605a68bbe1d1bbce1a363445388.cloudfront.net (CloudFront)
last-modified: Mon, 12 Apr 2021 08:54:56 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-C2
age: 32553
etag: "7acdc116a0830ba0aef5e087010246ba"
vary: Accept-Encoding
x-cache: Error from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 497
x-amz-cf-id: rlzcK2O86GdpXYRTxi9ty87a2eUSs6L848fc0B4uRPn3AN7AKM2pgQ==

GET
H2 200 plugin.min.js Show response
get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/ 287 KB
60 KB 113ms
11ms Script
application/javascript 2600:9000:24eb:4e00:11:a4de:2580:93a1

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Requested by: Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24eb:4e00:11:a4de:2580:93a1 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0595a4aaeb983c9d5f9c976475c5f5e892564ddf376413dda175681f5bca16e9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 17:07:13 GMT
content-encoding: gzip
via: 1.1 04af60474f4f87150ca027d2b7e267ce.cloudfront.net (CloudFront)
last-modified: Mon, 29 May 2023 12:23:17 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 81815
x-amz-server-side-encryption: AES256
etag: W/"6f89c85453b838e071d6740b30945d88"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 0mCbN6G6s6C2CXHplOsyQcT6cy5S3IroSYumhVl7AQhhmohV6ttyCg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 226 KB
80 KB 119ms
50ms Script
application/javascript 2607:f8b0:4020:806::2008

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-TQQXHHMPP3

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 -, , ASN (),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

18969e46c2396817023dd164102834e504a662d137b79f12f604f3638ab87ebf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81033
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 28 Jul 2023 15:50:29 GMT

GET
H3 200 wp-emoji-release.min.js Show response
el7lwa.com/degree/wp-includes/js/ 18 KB
5 KB 12ms
11ms Script
application/javascript 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566724
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Thu, 30 Mar 2023 02:09:57 GMT
server: cloudflare
etag: W/"6424ef75-4904"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nrB0aMnJEjkehXZqdnW7ZbtQeAM%2B%2FIKkOQ3Hh6RSnpC6mhEu1Y3mmpBKpQyfyVvXEgikvFkD%2Bcd8fjcWa6dXAs1SKfuXymq5gZF4RHYVzQilid7B7JZKN0UMp6jPAhT3sIILzWWwOhso"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 7ede472faed74294-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 email-decode.min.js Show response
el7lwa.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 19ms
9ms Script
application/javascript 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 28 Jul 2023 12:04:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64c3aed9-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hAf7mK%2Fb7GbyJ%2BASO%2FOUiGjR0mFpRh8IKbgBINmetNLvUHs6P6X3EnfBVkEqFrFvP%2F19irmQ7T8yjZJ2FssqJOrTiq3ICbqAQq0X%2FB3%2B7Fd9iF9FoX%2FiqezwSxWu1UptMWr4EZr0HD34"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7ede472f3e734294-EWR
expires: Sun, 30 Jul 2023 15:50:28 GMT

GET
H3 200 comment-reply.min.js Show response
el7lwa.com/degree/wp-includes/js/ 3 KB
2 KB 36ms
27ms Script
application/javascript 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-includes/js/comment-reply.min.js?ver=6.2.2

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566724
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Wed, 25 May 2022 02:09:49 GMT
server: cloudflare
etag: W/"628d8fed-ba5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M3VYn0BkiVnf2RFxJD2hZYfDIEb0feYpf4wvMcujEhysdWsRKxRcyG%2BZX%2FpZRkq0HwFrElL%2BQGR57zH4oY226thsGpXsj%2FjEaI3CaFIE9DpTYBw7xALqysQtnrToci4aIUTb7rqX8s6l"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 7ede472f3e744294-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 advertising.min.js Show response
el7lwa.com/degree/wp-content/plugins/better-adsmanager/js/ 29 B
542 B 27ms
18ms Script
application/javascript 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-content/plugins/better-adsmanager/js/advertising.min.js?ver=1.20.4

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7e76d44c88e8c172f66eb413a359494fdc7569ebac417ac2de0c2a232152dd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566723
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
content-length: 29
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Apr 2021 17:33:29 GMT
server: cloudflare
etag: "6075d5e9-1d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UtrCPXvPYmdho%2FmNqqC5GWCRA1wPy2MkKjKVAAQJyjXS9c6UilXymZ2ZbOpVB7narhai5tEHpD3LAHABCxUKIBb58fJpz9%2BvA69rN6hBERwHjGOCAdd1SEhEXc6TKf7N6V4t4CG%2FW2jk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7ede472f3e754294-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 0c133812b9706a9472445df5efb771c3.js Show response
el7lwa.com/degree/wp-content/bs-booster-cache/ 252 KB
75 KB 21ms
20ms Script
application/javascript 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-content/bs-booster-cache/0c133812b9706a9472445df5efb771c3.js?ver=6.2.2

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

538638ff5898160cb711d661e61eebd3d9d92042962e50310a0cc9c38da05aff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566723
content-encoding: br
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Apr 2021 17:33:31 GMT
server: cloudflare
etag: W/"6075d5eb-3f1e7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7rudhn4VtwyEOJYKb9wZpznpHPc6rtmZw1fY1D1A3ZSxxHfPCOAuJ5OuQjd%2ByJi4q6Y%2Fjh86uQG64a%2FKVOB71GV4z9DAYImiI2niOzteTfGXK1mnyIrnejO%2Fvbq0Jb1R3rU7H8e0QCpN"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 7ede472faed94294-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 fontawesome-webfont.woff2
el7lwa.com/degree/wp-content/themes/publisher/includes/libs/better-framework/assets/fonts/ 75 KB
76 KB 14ms
13ms Font
font/woff2 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://el7lwa.com/degree/wp-content/themes/publisher/includes/libs/better-framework/assets/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/wp-content/bs-booster-cache/713d65cd673abe5a6a9d3458fc8ffe97.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://el7lwa.com/degree/wp-content/bs-booster-cache/713d65cd673abe5a6a9d3458fc8ffe97.css
Origin: https://el7lwa.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566722
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
content-length: 77160
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Apr 2021 17:31:14 GMT
server: cloudflare
etag: "12d68-5bfddff43182f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AGoThTjcVm5Sf4d7NEnmhuicUIqke3F3tXq25fPhcevDKhDq9b8%2FBJNlNH1xV%2FQQ55EUZ8JaVzWP1WxT56HbW36YYNsO1wds4EJNJT2fiXvF0Vt4w1hOSdaf1yLpeIUwM67yq0kpqmrL"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=7776000
accept-ranges: bytes
cf-ray: 7ede472fdf1b4294-EWR
expires: Sun, 03 Sep 2023 19:18:27 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 90ms
19ms Font
font/woff2 2607:f8b0:4020:806::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700%7CRoboto:400,500,400italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://el7lwa.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:47:37 GMT
x-content-type-options: nosniff
age: 154972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:47:37 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 91ms
21ms Font
font/woff2 2607:f8b0:4020:806::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700%7CRoboto:400,500,400italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://el7lwa.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 21:57:17 GMT
x-content-type-options: nosniff
age: 582792
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Jul 2024 21:57:17 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 105ms
35ms Font
font/woff2 2607:f8b0:4020:806::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700%7CRoboto:400,500,400italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://el7lwa.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:32:19 GMT
x-content-type-options: nosniff
age: 155890
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:32:19 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 98ms
28ms Font
font/woff2 2607:f8b0:4020:806::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700%7CRoboto:400,500,400italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://el7lwa.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:55:54 GMT
x-content-type-options: nosniff
age: 154475
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:55:54 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/webp

POST
H2 204 collect
www.google-analytics.com/g/ 0
250 B 74ms
23ms Ping
text/plain 2001:4860:4802:34::178

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TQQXHHMPP3&gtm=45je37q0&_p=712039511&cid=364975040.1690559430&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1690559429&sct=1&seg=0&dl=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&dr=https%3A%2F%2Ft.co%2F&dt=TOP%2010%20DEGREES%20IN%20DEMAND%20FOR%202021%20%E2%80%93%20Online%20degrees&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TQQXHHMPP3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::178 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://el7lwa.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 84 KB
28 KB 132ms
83ms Script
text/javascript 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

29fef76cb9373bfc0dc79998458488d01a3e5fc630a1cb383b8ee4e6c21851d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28277
x-xss-protection: 0
server: cafe
etag: 478 / 19566 / 31076566 / config-hash: 5506091248545322359
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 28 Jul 2023 15:50:29 GMT

GET
H2 200 prebid7.36.2.js Show response
get.optad360.io/sf/ 524 KB
166 KB 9ms
9ms Script
application/javascript 2600:9000:24eb:4e00:11:a4de:2580:93a1

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/prebid7.36.2.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24eb:4e00:11:a4de:2580:93a1 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 128f76df591e53bde9def0aac6966f056566a6f46a80cc9dc7a8e0402520bd22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 12 Jul 2023 16:54:53 GMT
content-encoding: gzip
via: 1.1 04af60474f4f87150ca027d2b7e267ce.cloudfront.net (CloudFront)
last-modified: Tue, 28 Mar 2023 07:17:00 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 1378537
etag: W/"3b0c4914aba8fba88d5605bd77c7aa05"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=360000000
x-amz-cf-id: wywRE5-56ltuoJ0Q6cofH4h2nogMlRvIlsuxaurtiC-9acFk8CJe8g==

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 86ms
11ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52494
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: kzvIBZicrPd6uO2ExBTUKvzELjipqDWIRcteUjjuwNaY4rvat6Mttw==

GET
H3 200 images-44.jpeg
el7lwa.com/degree/wp-content/uploads/2021/04/ 8 KB
8 KB 15ms
14ms Image
image/jpeg 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://el7lwa.com/degree/wp-content/uploads/2021/04/images-44.jpeg

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c6f20129d94108a41c0c098d0d43d345c673f8b43855e2329c169a2029b9b8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566705
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Apr 2021 14:34:45 GMT
server: cloudflare
etag: W/"6075ac05-1e99"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Zo0pdO65BJTePAed2C5HzP1LSxlBb9lEGUzz1ZTZL4%2F6fPAO59pDp%2BylzRB9Awwb5B6EcEjLeYBnLv%2BqHlI%2Fxldjg4edhs%2FrPOJPmarhd7LGlodC1InEjZGuedh%2FmCsOJ892iT8xKkn"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
cf-ray: 7ede47335ad44294-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2339ef11fda2251b40f166a5a7cb764b
secure.gravatar.com/avatar/ 901 B
1 KB 22ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/2339ef11fda2251b40f166a5a7cb764b?s=26&d=mm&r=g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 96d69c07de6945a7f3b199641074634c0b3a6271ddf0f360acc93b113666f797

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Fri, 28 Jul 2023 15:50:29 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="2339ef11fda2251b40f166a5a7cb764b.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/2339ef11fda2251b40f166a5a7cb764b?s=26&d=mm&r=g>; rel="canonical"
content-length: 901
expires: Fri, 28 Jul 2023 15:55:29 GMT

GET
H3 200 images-44.jpeg
el7lwa.com/degree/wp-content/uploads/2021/04/ 8 KB
8 KB 13ms
11ms Image
image/jpeg 2606:4700:3031::6815:4dda
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://el7lwa.com/degree/wp-content/uploads/2021/04/images-44.jpeg

Requested by

Host: el7lwa.com
URL: https://el7lwa.com/degree/wp-content/bs-booster-cache/0c133812b9706a9472445df5efb771c3.js?ver=6.2.2

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:4dda , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c6f20129d94108a41c0c098d0d43d345c673f8b43855e2329c169a2029b9b8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4566705
x-cache: HIT from Backend
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Apr 2021 14:34:45 GMT
server: cloudflare
etag: W/"6075ac05-1e99"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0i3MBZu35GxHcntScmshLiqWbiP4Qox2lsUpqaBVBVOpQRov0b9n%2FE1kkfSGHQAq5ETewzithgHFhIB5H9NxNRlITwtZgl7Ml4t%2FJNpV5z1xiRFm1sudlyYUqveUeNxjMuh68llqtCab"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
cf-ray: 7ede47338af74294-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2339ef11fda2251b40f166a5a7cb764b
secure.gravatar.com/avatar/ 901 B
941 B 3ms
3ms Image
image/jpeg 2a04:fa87:fffe::c000:4902

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/2339ef11fda2251b40f166a5a7cb764b?s=26&d=mm&r=g
Requested by: Host: el7lwa.com
URL: https://el7lwa.com/degree/wp-content/bs-booster-cache/0c133812b9706a9472445df5efb771c3.js?ver=6.2.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 96d69c07de6945a7f3b199641074634c0b3a6271ddf0f360acc93b113666f797

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-nc: HIT jfk 1
date: Fri, 28 Jul 2023 15:50:29 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="2339ef11fda2251b40f166a5a7cb764b.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/2339ef11fda2251b40f166a5a7cb764b?s=26&d=mm&r=g>; rel="canonical"
content-length: 901
expires: Fri, 28 Jul 2023 15:55:29 GMT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 17ms
4ms XHR
application/json 2a04:4e42:400::485

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230728

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 -, , ASN (),

Reverse DNS

Software

Resource Hash

e1d764f3e532938e603f338c298fbe772f04b9e709b38384584f5efd4f96387d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 28 Jul 2023 15:50:29 GMT
x-content-type-options: nosniff
content-encoding: br
age: 42580
x-jsd-version: 1.0.1764
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 773
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21945-LGA
x-jsd-version-type: version
etag: W/"633-T7bet19gBazoR2hlcOPepND1zVk"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
189 B 69ms
27ms XHR
text/plain 2620:100:a001::18

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.36.0&cb=22617955929&lsavail=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 204 / Show response
ssp.wp.pl/bidder/ 0
170 B 644ms
116ms XHR
text/plain 212.77.99.29

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H2 200 c Show response
prebid.a-mo.net/a/ 829 B
1 KB 50ms
0ms XHR
application/json 147.75.195.77

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.77 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash: 8716acb5313a21804b90a7ebfe9097ac03f77318040bfaca3adc9ca7c3574053

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 506

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 2 KB
1 KB 612ms
88ms XHR
application/json 23.227.137.154

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.137.154 -, , ASN (),
Reverse DNS
Software: Adtelligent /
Resource Hash: 154523c0e4bb54705a3073619d1abcdf13d25cb6a26850d03907bf1d3d060ee6

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 28 Jul 2023 15:50:30 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://el7lwa.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 749

POST
H2 200 pbjs Show response
useast.quantumdex.io/auction/ 2 B
155 B 175ms
55ms XHR
application/json 2606:4700:10::6816:2560

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/pbjs
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2560 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: https://el7lwa.com
access-control-allow-credentials: true
cf-ray: 7ede47354be7436c-EWR
content-length: 2

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
698 B 31ms
3ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

029d6f388a42f0beb6191c9a2f38b10fcb60bda49d49468b480b26a55961da11

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
an-x-request-uuid: fdf14e7e-4e28-4bcb-981f-b7b58d26ee42
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 139
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 547ms
80ms XHR
application/json 185.106.140.18

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: afb72cd01000ff280894580cf3cffa702e5cd05b3461e4290cfe34c651a57318

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:30 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://el7lwa.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1885
Expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 50 B
607 B 36ms
12ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
an-x-request-uuid: 96bb1711-3b06-4e0a-9ea4-d59fcd932703
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 50
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
172 B 550ms
83ms XHR
text/plain 185.184.8.90

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST /
prebid.smilewanted.com/ 0
0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
358 B 123ms
15ms XHR
application/json 51.222.39.184

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 -, , ASN (),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://el7lwa.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST /
prebid.smilewanted.com/ 0
0

POST
H2 204 / Show response
ssp.wp.pl/bidder/ 0
17 B 620ms
117ms XHR
text/plain 212.77.99.29

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 536ms
82ms XHR
application/json 185.106.140.18

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 2654cffb7bc20d85b2c1eff65bf42556b00595473b2279dd37ebe1c7068b8179

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:30 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://el7lwa.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1885
Expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
697 B 37ms
22ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

5991417faf110c766a11f0392ed46de4adb3eba8ad9e3d9b75a06460c44b93a9

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
an-x-request-uuid: 86459eb4-2c55-4323-a734-af005aee4c51
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 139
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 pbjs Show response
useast.quantumdex.io/auction/ 2 B
155 B 156ms
58ms XHR
application/json 2606:4700:10::6816:2560

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/pbjs
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2560 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: https://el7lwa.com
access-control-allow-credentials: true
cf-ray: 7ede47354be9436c-EWR
content-length: 2

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
188 B 53ms
41ms XHR
text/plain 2620:100:a001::18

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.36.0&cb=16135592825&lsavail=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 c Show response
prebid.a-mo.net/a/ 829 B
900 B 24ms
0ms XHR
application/json 147.75.195.77

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.77 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash: 60a38262577d08663ee6886935bbfd57c1f4547b4c778188ade7405853788504

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 507

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
172 B 537ms
85ms XHR
text/plain 185.184.8.90

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H/1.1 200
OK /
ghb1.adtelligent.com/v2/auction/ 2 KB
1 KB 717ms
220ms XHR
application/json 23.227.137.154

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb1.adtelligent.com/v2/auction/
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.137.154 -, , ASN (),
Reverse DNS
Software: Adtelligent /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 28 Jul 2023 15:50:30 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://el7lwa.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 740

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
357 B 111ms
16ms XHR
application/json 51.222.39.184

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 -, , ASN (),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://el7lwa.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 50 B
607 B 16ms
10ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
an-x-request-uuid: 2543555e-825b-4b5c-a00b-bf2fa0b59fa6
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 50
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/ 387 KB
123 KB 83ms
19ms Script
text/javascript 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

aecbcd81ab4ba067ecfc856682cb5d34b2249db6564ae0e4f3f23422b734dc31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 19:37:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72782
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 125612
x-xss-protection: 0
server: cafe
etag: 13662757064411976442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 26 Jul 2024 19:37:27 GMT

POST /
prebid.smilewanted.com/ 0
0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
697 B 150ms
98ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

c78e2064607d62e3d40dcc77d241c5ca3a5dd30f4756f78e76a16ec1fd5f939e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
an-x-request-uuid: b7b44fd1-ef0f-4fda-8bfa-e70e54424cd7
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 139
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 / Show response
ssp.wp.pl/bidder/ 0
17 B 571ms
117ms XHR
text/plain 212.77.99.29

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H/1.1 200
OK / Show response
ghb2.adtelligent.com/v2/auction/ 2 KB
1 KB 600ms
214ms XHR
application/json 2a06:8640:454:0:e082:abff:fefe:d1d2

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb2.adtelligent.com/v2/auction/
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:8640:454:0:e082:abff:fefe:d1d2 -, , ASN (),
Reverse DNS
Software: Adtelligent /
Resource Hash: b0b0742e61062626033382699d7aea07a9f12590f16dd70c8c4a09b2787729bc

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 28 Jul 2023 15:50:30 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://el7lwa.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 751

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
188 B 77ms
28ms XHR
text/plain 2620:100:a001::18

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.36.0&cb=45283154174&lsavail=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:28 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 50 B
607 B 59ms
12ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
an-x-request-uuid: 6bd451ad-6141-4491-bb51-066b7777ad7b
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 50
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 484ms
84ms XHR
application/json 185.106.140.18

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: badba5d0fd7389ca5e2025cc0d130a37ab6aa96ed709fc0150ee3e9accd01310

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:30 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://el7lwa.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1885
Expires: 0

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
172 B 490ms
88ms XHR
text/plain 185.184.8.90

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H2 200 pbjs Show response
useast.quantumdex.io/auction/ 2 B
155 B 98ms
56ms XHR
application/json 2606:4700:10::6816:2560

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/pbjs
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2560 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: https://el7lwa.com
access-control-allow-credentials: true
cf-ray: 7ede47354bea436c-EWR
content-length: 2

POST
H2 200 c Show response
prebid.a-mo.net/a/ 829 B
658 B 54ms
12ms XHR
application/json 147.75.195.77

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.77 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash: 2d3660f045d3d7331eca69b438f8dc351ed05b6f1551cfcf74f5cd6c446ed24d

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 508

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
357 B 58ms
17ms XHR
application/json 51.222.39.184

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 -, , ASN (),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://el7lwa.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 pbjs Show response
useast.quantumdex.io/auction/ 2 B
296 B 78ms
44ms XHR
application/json 2606:4700:10::6816:2560

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/pbjs
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2560 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: https://el7lwa.com
access-control-allow-credentials: true
cf-ray: 7ede47354beb436c-EWR
content-length: 2

POST /
prebid.smilewanted.com/ 0
0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 50 B
607 B 39ms
10ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
an-x-request-uuid: 934633fb-34ba-4336-982a-21d179b17017
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 50
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
697 B 39ms
11ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

89cdf50daef9e296f56cdf7232fb7993bee7d17bb4c21ad89388191d2fc38446

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
an-x-request-uuid: 3139d5fb-b10f-4dc7-bac7-edd79fecf0da
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 139
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
173 B 467ms
83ms XHR
text/plain 185.184.8.90

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H2 204 / Show response
ssp.wp.pl/bidder/ 0
17 B 547ms
118ms XHR
text/plain 212.77.99.29

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 457ms
81ms XHR
application/json 185.106.140.18

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: eea35b9ad480903527d6e81449d165f1d719f5cb6de0fce541b32914f4e59b9f

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:30 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://el7lwa.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1885
Expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
357 B 40ms
18ms XHR
application/json 51.222.39.184

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 -, , ASN (),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://el7lwa.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 c Show response
prebid.a-mo.net/a/ 829 B
657 B 30ms
13ms XHR
application/json 147.75.195.77

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.77 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash: f39c440545917b3958467aba2277b8798295c85580f3581a4f1e7fa9d79ef597

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 509

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
188 B 46ms
29ms XHR
text/plain 2620:100:a001::18

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.36.0&cb=9295949592&lsavail=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 2 KB
1 KB 462ms
44ms XHR
application/json 23.227.137.154

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.137.154 -, , ASN (),
Reverse DNS
Software: Adtelligent /
Resource Hash: b758f1339a9633530f995b11ea8edf75405d1344cab80e27a060fba2bf02830e

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 28 Jul 2023 15:50:30 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://el7lwa.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 758

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 24ms
13ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52494
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: LBgbuJKhjHH5LPWL4HEUr-LA5x163295V-VORSlffxy6cz086O8jpw==

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 10ms
10ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52495
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: hVQcPOtsSGBiUXRqkJ6YBEoaZWoPz8e6_l1vZ45fTc5vwNFd7-4ZMg==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 118ms
4ms Script
application/javascript 34.102.146.192

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 12:28:26 GMT
content-encoding: gzip
age: 184924
x-guploader-uploadid: ADPycdsGdQuX-toVH-E0tifTADZcb5wvY7rDnQMHqTBLMZ4Lp2EXR51yKZ67JvI6z7wJsGCFuMQj-cFQfWi7T1w_IRjtgg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 25 Jul 2024 12:28:26 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 142ms
25ms Script
text/javascript 2620:100:a001::4

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

b118568858df50612fa3591132d6d6bb41ddf00f8c74ad8cccd16e5510691aad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Jul 2023 13:25:47 GMT
server: nginx
etag: W/"64ad585b-a980"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 29 Jul 2023 15:50:30 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 38 KB
12 KB 167ms
8ms Script
text/javascript 13.249.190.38

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.190.38 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0c2ec1f2d626ab278d81abe34d30681f0007e8c79a890165f27e3e1550e99b7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 08:31:49 GMT
content-encoding: gzip
via: 1.1 07da2322976c8f91428dfa17020aeda2.cloudfront.net (CloudFront)
last-modified: Wed, 31 May 2023 20:34:33 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-C2
age: 26322
x-amz-server-side-encryption: AES256
etag: W/"550ead3a95bd6cfcd917d45c5f8f4553"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 89uXOK5LgmsBlHaElZ7vPJgkNa7wpv8HSBq1ykgEp2GIMR8R-qFfSA==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 121ms
9ms Script
text/javascript 2600:9000:26dc:3e00:a:e047:753:be1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26dc:3e00:a:e047:753:be1 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
Date: Fri, 28 Jul 2023 09:10:37 GMT
Via: 1.1 8e88e89c560961cfc1c3e8bf8af2ec84.cloudfront.net (CloudFront)
Last-Modified: Thu, 04 May 2023 00:14:06 GMT
Server: AmazonS3
X-Amz-Cf-Pop: BOS50-P4
Age: 23994
x-amz-server-side-encryption: AES256
ETag: "4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1858
X-Amz-Cf-Id: etbPTAn5s1CBcQqzhXNaACzLysL1ksLb4HvLEzSi4w0pWU5GbqabmA==

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
815 B 160ms
5ms Script
application/javascript 2a04:4e42:400::485

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42:400::485 -, , ASN (),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 28 Jul 2023 15:50:30 GMT
x-content-type-options: nosniff
content-encoding: br
age: 16225
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-lga21941-LGA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 102 KB
25 KB 175ms
18ms Script
text/javascript 2606:4700:10::ac43:266a

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

4924e12a30059184d9bd1c36294dcdf957f5f2da452209448b35a93aa785cca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Jun 2023 08:35:03 GMT
server: cloudflare
x-amz-request-id: YM9EEYYH9DVMFRHQ
age: 590
etag: W/"9b8b8eb50e4814cbdc325ce477c96910"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7ede4737cce078d6-EWR
x-amz-id-2: PjNGGJ7rImMYTsqoXgaGyZE+cP9/mE6oEWmWhiLDC3JBDQULAI1GdEjyAjaaL26tBMujY+xprog=

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
2 KB 248ms
95ms Script
text/javascript 34.96.70.87

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 -, , ASN (),
Reverse DNS
Software: Google Frontend /
Resource Hash: 1c54b9d1b579c59f8245fd21a021725c0dbde06ec90f44df1bbc03458f40dfe8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
via: 1.1 google, 1.1 google
last-modified: Wed, 05 Jul 2023 19:08:57 GMT
server: Google Frontend
etag: 6c49a4094d9a446bdc7fe3d19d23b4c7
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: ade9d25e31421f3c82cc74ba0acddf8b
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1311

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 9ms
8ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52495
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: kJCTZO5hxMZEeemfxTEa0iu3ZW6A2jb5V_YHMTgHMK805kcXoWTVLA==

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 20ms
20ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52495
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: m1a7nUwtMgsaJ5Gy9Rw3W-iZ3zINK8Gf8PjKJ3O30MvxsWhkh5aHtA==

GET
H2

200

esp
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&rid=esp&cc=1

85 B
202 B

32ms
31ms

Fetch
application/json

34.120.135.53

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&rid=esp&cc=1
Protocol: H2
Server: 34.120.135.53 -, , ASN (),
Reverse DNS
Software: / Express
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-bwWP/lFk/swBHPbq9bTubdI/2pY"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Fri, 28 Jul 2023 15:50:30 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://el7lwa.com
location: /esp?url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 47A5 15 KB
6 KB 50ms
12ms Document
text/html 2620:100:a001::c

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=el7lwa.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:29 GMT
server: Kestrel
server-processing-duration-in-ticks: 291487
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 154 B
608 B 75ms
23ms XHR
application/json 34.206.201.46

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.201.46 -, , ASN (),
Reverse DNS
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 44f62e506bc0795f05f1be751e6db40d5f7a5f64af70a791c7735bfd07bae187

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://el7lwa.com
cache-control: no-cache
x-server: 10.40.11.178
access-control-allow-credentials: true
content-length: 154
expires: 0

GET
H/1.1 204 increment
id5-sync.com/api/esp/ 0
319 B 414ms
96ms XHR
text/plain 141.95.33.111

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 -, , ASN (),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

sid
mug.criteo.com/ Frame 47A5
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=el7lwa.com&sn=ChromeSyncframe&so=0&topUrl=el7lwa.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=lc_S4Xx6MldCTW9GU3hVM3ZacU05SVBmTFZ6Kys2ZmtkZFVaSUY3Ylk3VnJacGgvRWE4bWtXbTRIQVJYY1RMY2RRVXF0ck9icVdqN2hkTHVockhuYzVuUkhKVFdmaDBVZGJHRlE1Q1FuTE4vT1hiY3hWZEtmeURzZVUvbG...

454 B
659 B

74ms
11ms

Fetch
application/json

74.119.119.139

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=lc_S4Xx6MldCTW9GU3hVM3ZacU05SVBmTFZ6Kys2ZmtkZFVaSUY3Ylk3VnJacGgvRWE4bWtXbTRIQVJYY1RMY2RRVXF0ck9icVdqN2hkTHVockhuYzVuUkhKVFdmaDBVZGJHRlE1Q1FuTE4vT1hiY3hWZEtmeURzZVUvbGhnVzdoSWVMT21wTFFLd1g5QkdDbzQ5bEpoTVRRdmwvWTVIeWpoVEFhNUF6Y2xQMW9lQkdpOXlLOEVka0tSOXNiUHdkZjBOQXZnVTV4a2NVeGF0RDlHclFFb2lud1dwMVFPdzJRZEtlbFFCMWl3Ny96Q3R4ZUFhM1pmRjhXYzNxYUJYOFNXaHM5MU90OVUzNFppaVJaUDZJV2lxeUg3UT09fA&cppv=2

Protocol

Server

74.119.119.139 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1534174
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:29 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=lc_S4Xx6MldCTW9GU3hVM3ZacU05SVBmTFZ6Kys2ZmtkZFVaSUY3Ylk3VnJacGgvRWE4bWtXbTRIQVJYY1RMY2RRVXF0ck9icVdqN2hkTHVockhuYzVuUkhKVFdmaDBVZGJHRlE1Q1FuTE4vT1hiY3hWZEtmeURzZVUvbGhnVzdoSWVMT21wTFFLd1g5QkdDbzQ5bEpoTVRRdmwvWTVIeWpoVEFhNUF6Y2xQMW9lQkdpOXlLOEVka0tSOXNiUHdkZjBOQXZnVTV4a2NVeGF0RDlHclFFb2lud1dwMVFPdzJRZEtlbFFCMWl3Ny96Q3R4ZUFhM1pmRjhXYzNxYUJYOFNXaHM5MU90OVUzNFppaVJaUDZJV2lxeUg3UT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 350287
content-length: 0
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
357 B 13ms
11ms XHR
application/json 51.222.39.184

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 -, , ASN (),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://el7lwa.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H/1.1 200
OK auction
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 83ms
81ms XHR
application/json 185.106.140.18

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:30 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://el7lwa.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1885
Expires: 0

POST
H2 204 /
ssp.wp.pl/bidder/ 0
17 B 116ms
113ms XHR
text/plain 212.77.99.29

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H2 200 cdb
bidder.criteo.com/ 2 KB
2 KB 62ms
60ms XHR
application/json 2620:100:a001::18

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.36.0&cb=9633388244&lsavail=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://el7lwa.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

POST
H2 204 bids
prebid-eu.creativecdn.com/bidder/prebid/ 0
172 B 88ms
72ms XHR
text/plain 185.184.8.90

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://el7lwa.com
date: Fri, 28 Jul 2023 15:50:30 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H2 200 c
prebid.a-mo.net/a/ 975 B
652 B 17ms
14ms XHR
application/json 147.75.195.77

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.77 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 8
content-length: 478

POST /
prebid.smilewanted.com/ 0
0

POST
H2 200 prebid
ib.adnxs.com/ut/v3/ 140 B
698 B 5ms
3ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
an-x-request-uuid: dd627b87-ec0e-4833-8755-00e98d40e1be
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 140
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 pbjs
useast.quantumdex.io/auction/ 2 B
155 B 202ms
200ms XHR
application/json 2606:4700:10::6816:2560

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/pbjs
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2560 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: https://el7lwa.com
access-control-allow-credentials: true
cf-ray: 7ede4738ef75436c-EWR
content-length: 2

POST
H/1.1 200
OK /
ghb1.adtelligent.com/v2/auction/ 2 KB
1 KB 39ms
38ms XHR
application/json 23.227.137.154

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb1.adtelligent.com/v2/auction/
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.137.154 -, , ASN (),
Reverse DNS
Software: Adtelligent /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 28 Jul 2023 15:50:30 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://el7lwa.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 769

POST
H2 200 prebid
ib.adnxs.com/ut/v3/ 50 B
607 B 8ms
7ms XHR
application/json 68.67.160.184

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
an-x-request-uuid: c80e069c-be81-493f-974a-1b71bb287f72
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 50
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 ads
securepubads.g.doubleclick.net/gampad/ 127 KB
46 KB 765ms
764ms XHR
text/plain 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1525505719642836&correlator=3519215692106670&eid=31076566&output=ldjh&gdfp_req=1&vrg=202307260102&ptt=17&impl=fif&iu_parts=121764058%3A22350065965%2Cel7lwa.com%2Cel7lwa.com_adi_W1z&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x600%7C300x250%7C240x400%7C160x600%7C120x600&ifi=1&adks=2839352561&didk=1823312327&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1690559430600&lmt=1690559430&adxs=1045&adys=1062&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=26&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&ref=https%3A%2F%2Ft.co%2F&frm=20&vis=1&psz=0x-1&msz=300x-1&fws=640&ohw=0&ga_vid=364975040.1690559430&ga_sid=1690559431&ga_hid=712039511&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYuvzG6ZkxSABSAghkEhkKCnB1YmNpZC5vcmcYg_7G6ZkxSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGLr8xumZMUgAUgIIZBIXCghydGJob3VzZRi7_MbpmTFIAFICCGQSFAoFb3BlbngYuvzG6ZkxSABSAghkEhkKCnVpZGFwaS5jb20YuvzG6ZkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi7_MbpmTFIAFICCGQ.&dlt=1690559428871&idt=1286

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CODb2dLgsYADFdHiswodNiQHVw&gqi=&layout=/sadbundle/%24csp%253Der3%24/18247533069586716790/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CODb2dLgsYADFdHiswodNiQHVw&gqi=&layout=/sadbundle/%24csp%253Der3%24/18247533069586716790/index.html
date: Fri, 28 Jul 2023 15:50:31 GMT
x-content-type-options: nosniff
content-encoding: br
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46922
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar
pagead2.googlesyndication.com/getconfig/ 15 KB
12 KB 209ms
53ms XHR
application/json 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202307260102&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11771
x-xss-protection: 0

GET
H2 200 container.html
3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B820 6 KB
3 KB 131ms
35ms Document
text/html 2607:f8b0:4020:806::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:30 GMT
expires: Sat, 27 Jul 2024 15:50:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads
securepubads.g.doubleclick.net/gampad/ 21 KB
9 KB 1457ms
1456ms XHR
text/plain 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1525505719642836&correlator=3519215692106670&eid=31076566&output=ldjh&gdfp_req=1&vrg=202307260102&ptt=17&impl=fif&iu_parts=121764058%3A22350065965%2Cel7lwa.com%2Cel7lwa.com_adi_S1&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=360x300%7C336x280%7C300x250%7C280x250%7C250x250&ifi=2&adks=415194616&didk=2258869040&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1690559430647&lmt=1690559430&adxs=521&adys=924&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=26&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&ref=https%3A%2F%2Ft.co%2F&frm=20&vis=1&psz=0x-1&msz=360x-1&fws=640&ohw=0&ga_vid=364975040.1690559430&ga_sid=1690559431&ga_hid=712039511&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYuvzG6ZkxSABSAghkEhkKCnB1YmNpZC5vcmcYg_7G6ZkxSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGLr8xumZMUgAUgIIZBIXCghydGJob3VzZRi7_MbpmTFIAFICCGQSFAoFb3BlbngYuvzG6ZkxSABSAghkEhkKCnVpZGFwaS5jb20YuvzG6ZkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi7_MbpmTFIAFICCGQ.&dlt=1690559428871&idt=1286

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:32 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9589
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 encrypt
esp.rtbhouse.com/ 265 B
360 B 94ms
92ms Fetch
application/json 35.190.39.111

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 -, , ASN (),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Referer: https://el7lwa.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 7360d9f092e11f70681e3566cd4d000c
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265

GET
H3 200 ads
securepubads.g.doubleclick.net/gampad/ 128 KB
46 KB 1895ms
1894ms XHR
text/plain 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1525505719642836&correlator=3519215692106670&eid=31076566&output=ldjh&gdfp_req=1&vrg=202307260102&ptt=17&impl=fif&iu_parts=121764058%3A22350065965%2Cel7lwa.com%2Cel7lwa.com_adi_S1z&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=360x300%7C336x280%7C300x250%7C280x250%7C250x250&ifi=3&adks=807086543&didk=42084984&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1690559430709&lmt=1690559430&adxs=330&adys=924&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=26&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&ref=https%3A%2F%2Ft.co%2F&frm=20&vis=1&psz=0x-1&msz=360x-1&fws=640&ohw=0&ga_vid=364975040.1690559430&ga_sid=1690559431&ga_hid=712039511&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYuvzG6ZkxSABSAghkEhkKCnB1YmNpZC5vcmcYg_7G6ZkxSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGLr8xumZMUgAUgIIZBIXCghydGJob3VzZRi7_MbpmTFIAFICCGQSFAoFb3BlbngYuvzG6ZkxSABSAghkEhkKCnVpZGFwaS5jb20YuvzG6ZkxSABSAghkEhsKDGlkNS1zeW5jLmNvbRi7_MbpmTFIAFICCGQ.&dlt=1690559428871&idt=1286

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNa3r9PgsYADFXMgiAkdcmYHMA&gqi=&layout=/sadbundle/%24csp%253Der3%24/6757697843937859061/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNa3r9PgsYADFXMgiAkdcmYHMA&gqi=&layout=/sadbundle/%24csp%253Der3%24/6757697843937859061/index.html
date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
content-encoding: br
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47069
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://el7lwa.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads
securepubads.g.doubleclick.net/gampad/ 56 KB
13 KB 2291ms
2290ms XHR
text/plain 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1525505719642836&correlator=3519215692106670&eid=31076566&output=ldjh&gdfp_req=1&vrg=202307260102&ptt=17&impl=fif&iu_parts=121764058%3A22350065965%2Cel7lwa.com%2Cel7lwa.com_SF&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C750x100%7C970x90&ifi=4&adks=4168576785&didk=1756619688&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1690559430737&lmt=1690559430&adxs=436&adys=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=4&oid=2&u_his=26&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&ref=https%3A%2F%2Ft.co%2F&frm=20&vis=1&psz=0x-1&msz=728x-1&fws=640&ohw=0&ga_vid=364975040.1690559430&ga_sid=1690559431&ga_hid=712039511&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABjEgMfpmTFIABIZCgpwdWJjaWQub3JnGIP-xumZMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRi6_MbpmTFIAFICCGQSFwoIcnRiaG91c2UYu_zG6ZkxSABSAghkEhQKBW9wZW54GLr8xumZMUgAUgIIZBIZCgp1aWRhcGkuY29tGLr8xumZMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yu_zG6ZkxSABSAghk&dlt=1690559428871&idt=1286

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:33 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13706
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://el7lwa.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 184ms
91ms Preflight
text/plain 35.190.39.111

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 -, , ASN (),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://el7lwa.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://el7lwa.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Fri, 28 Jul 2023 15:50:30 GMT
server: Google Frontend
vary: Origin
via: 1.1 google, 1.1 google
x-cloud-trace-context: a4d46c2dcf1dbe9483a705ae428f6fc6

GET
H2 200 pd
google-bidout-d.openx.net/w/1.0/ Frame 3650 594 B
804 B 53ms
28ms Document
text/html 35.244.159.8

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 -, , ASN (),
Reverse DNS
Software: OXGW/0.0.0 /
Resource Hash

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 386
content-type: text/html
date: Fri, 28 Jul 2023 15:50:30 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 10ms
9ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52495
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: 7qadC3iCrn0DY-tGFm3cbsueP6x331pBFJ0Cqh3B8YSd4SFiWZy-8A==

GET ads
securepubads.g.doubleclick.net/gampad/ 0
0

GET
H2 200 publishertag.prebid.134.js
static.criteo.net/js/ld/ 89 KB
29 KB 26ms
24ms Script
text/javascript 2620:100:a001::4

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.134.js

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:15:33 GMT
server: nginx
etag: W/"642e8db5-162ff"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 29 Jul 2023 15:50:30 GMT

GET
H2 200 sodar2.js
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 581ms
102ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 28 Jul 2023 15:50:31 GMT

GET
H2 200 165b44c9-a484-eaee-f822-ed1900efd5f7
pr-bh.ybp.yahoo.com/sync/openx/ Frame 3650 43 B
603 B 54ms
14ms Image
image/gif 2600:1f18:4e9:5a01:b943:7cee:b004:871e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/165b44c9-a484-eaee-f822-ed1900efd5f7?gdpr=0

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:b943:7cee:b004:871e -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:30 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 3650
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=da4a5ef0-2882-c35d-09fb-797b978bd35e
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=da4a5ef0-2882-c35d-09fb-797b978bd35e&dcc=t

43 B
855 B

38ms
37ms

Image
image/gif

209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=da4a5ef0-2882-c35d-09fb-797b978bd35e&dcc=t

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

HTTP/1.1

Server

209.54.182.161 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:31 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 9YRG012VD03EWE9VSVHT
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:30 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Y7DCP6HWH8AENSY2XE2P
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=da4a5ef0-2882-c35d-09fb-797b978bd35e&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 3650
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=876fe874-f014-4772-90fd-ff394036b1ac&ttd_puid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0&gdpr_consent=

43 B
314 B

37ms
26ms

Image
image/gif

35.244.159.8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=876fe874-f014-4772-90fd-ff394036b1ac&ttd_puid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 -, , ASN (),
Reverse DNS
Software: OXGW/0.0.0 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:31 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=876fe874-f014-4772-90fd-ff394036b1ac&ttd_puid=829c228d-3428-78a7-c9f5-fbecffb818be&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 3650
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWVmM2YxNDctZmQ1Zi0yNjAzLWRjMTUtYTE1NTM1NWFkNmRl
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWVmM2YxNDctZmQ1Zi0yNjAzLWRjMTUtYTE1NTM1NWFkNmRl&google_tc=

170 B
243 B

41ms
40ms

Image
image/png

172.217.13.98

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWVmM2YxNDctZmQ1Zi0yNjAzLWRjMTUtYTE1NTM1NWFkNmRl&google_tc=

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Server

172.217.13.98 -, , ASN (),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWVmM2YxNDctZmQ1Zi0yNjAzLWRjMTUtYTE1NTM1NWFkNmRl&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 3650
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEkMS5EqDH7dNv6riYYxO8Q&google_cver=1

43 B
97 B

30ms
29ms

Image
image/gif

35.244.159.8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEkMS5EqDH7dNv6riYYxO8Q&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 -, , ASN (),
Reverse DNS
Software: OXGW/0.0.0 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:31 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEkMS5EqDH7dNv6riYYxO8Q&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe
gum.criteo.com/ Frame 9B0E 15 KB
6 KB 13ms
10ms Document
text/html 2620:100:a001::c

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=el7lwa.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.134.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:30 GMT
server: Kestrel
server-processing-duration-in-ticks: 726792
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.134.js
static.criteo.net/js/ld/ 89 KB
29 KB 37ms
15ms XHR
text/javascript 2620:100:a001::4

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.134.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.134.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:31 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:15:33 GMT
server: nginx
etag: W/"642e8db5-162ff"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 29 Jul 2023 15:50:31 GMT

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 8ms
8ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/d7126ecb-f392-4f8b-94db-bf25b0fac7d3/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52496
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: laebWAAG48wPdQW2NtqyRMpQ-qejbtPONB2KP83W-ZzZt8S_LL0aCw==

GET
H2

200

sid
mug.criteo.com/ Frame 9B0E
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=el7lwa.com&sn=ChromeSyncframe&so=3&topUrl=el7lwa.com&bundle=fg90JF9LaXF5QmglMkZBbE9MVFdyNXlDeTRXOVVkOTNYZmVNWFBaRGxpdXAlMkZkWCUyQkl3ODl6dz...
https://mug.criteo.com/sid?cpp=gdbT23wxQ3IzRkFuTmRXdWphQjQ3NlZXcDZ2enpqZVpyRXk4OHJMeVVCeWJveXJBNEg5dmNrWjhzS0VnaG1YaEt5VG5CVFRMYnltRnBZTE9aL05rMS9QTktmR25zVmVQNGtWNHlVQ0NyZ01OM3M2MTdxbCttS0tGYnE5QV...

436 B
655 B

11ms
11ms

Fetch
application/json

74.119.119.139

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=gdbT23wxQ3IzRkFuTmRXdWphQjQ3NlZXcDZ2enpqZVpyRXk4OHJMeVVCeWJveXJBNEg5dmNrWjhzS0VnaG1YaEt5VG5CVFRMYnltRnBZTE9aL05rMS9QTktmR25zVmVQNGtWNHlVQ0NyZ01OM3M2MTdxbCttS0tGYnE5QVZ1MEdBeFVQS2FsWHhxSm9QcDVXWGwrT2luRnhieUgvekpFNlJOdVV3NXZwNytBSWdsS2h0QS91QzRlK2MrUGVvc3M4NGFuYnFGeXJJU3ZtT1VENDV6K1A4MVRaKzdJSUNicTl6K2xiS3AxNWlMR3c5Z2FEeW84YUI5eUw2Tk5DSUxZak92U2NYMWl1L1BMd0dXcGUrSlZmRXNmLzNYdUdIRTJSQ2k5UEpIbURuQmZRY1Q1bz18&cppv=2

Protocol

Server

74.119.119.139 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1045511
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:30 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=gdbT23wxQ3IzRkFuTmRXdWphQjQ3NlZXcDZ2enpqZVpyRXk4OHJMeVVCeWJveXJBNEg5dmNrWjhzS0VnaG1YaEt5VG5CVFRMYnltRnBZTE9aL05rMS9QTktmR25zVmVQNGtWNHlVQ0NyZ01OM3M2MTdxbCttS0tGYnE5QVZ1MEdBeFVQS2FsWHhxSm9QcDVXWGwrT2luRnhieUgvekpFNlJOdVV3NXZwNytBSWdsS2h0QS91QzRlK2MrUGVvc3M4NGFuYnFGeXJJU3ZtT1VENDV6K1A4MVRaKzdJSUNicTl6K2xiS3AxNWlMR3c5Z2FEeW84YUI5eUw2Tk5DSUxZak92U2NYMWl1L1BMd0dXcGUrSlZmRXNmLzNYdUdIRTJSQ2k5UEpIbURuQmZRY1Q1bz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 558254
content-length: 0
expires: 0

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 10ms
9ms Image
image/svg+xml 18.161.21.99

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.99 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:15:36 GMT
content-encoding: gzip
via: 1.1 266398c48167bf812d01820529b531e0.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 52496
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: hlhHpUnSO-wA1QgCDaod1U9MBeW2rKsVLKPqUKEqcx-RoXLZnTJXMA==

GET
H2 200 container.html
3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame BA15 6 KB
3 KB 22ms
17ms Document
text/html 2607:f8b0:4020:806::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:30 GMT
expires: Sat, 27 Jul 2024 15:50:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0629 13 KB
5 KB 41ms
29ms Document
text/html 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 156050
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:29:41 GMT
expires: Thu, 25 Jul 2024 20:29:41 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe
www.google.com/recaptcha/api2/ Frame 0CF5 783 B
1 KB 133ms
45ms Document
text/html 2607:f8b0:4020:807::2004

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 -, , ASN (),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nLiVBWuecOYUVtOVXiRrYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-nLiVBWuecOYUVtOVXiRrYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:31 GMT
expires: Fri, 28 Jul 2023 15:50:31 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/ Frame CBA9 15 KB
4 KB 60ms
49ms Document
text/html 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Requested by

Host: spotify-online.cleverapps.io
URL: https://spotify-online.cleverapps.io/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 369606
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3883
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Jul 2023 09:10:25 GMT
expires: Tue, 23 Jul 2024 09:10:25 GMT
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/ Frame BA15 23 KB
9 KB 17ms
17ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/abg_lite_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61265
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H2 200 s
googleads.g.doubleclick.net/pagead/drt/ Frame E09E 143 B
247 B 17ms
14ms Document
text/html 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1736
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:21:35 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame BA15 3 KB
1 KB 32ms
31ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61265
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H3 200 qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame BA15 20 KB
8 KB 27ms
27ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61265
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H2 200 rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame BA15 179 KB
57 KB 102ms
53ms Script
text/javascript 2607:f8b0:4020:807::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 28 Jul 2023 15:50:31 GMT

GET
DATA 200
OK truncated
/ Frame BA15 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js
pagead2.googlesyndication.com/bg/ Frame 0629 37 KB
14 KB 50ms
13ms Script
text/javascript 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 21:04:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 153972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 21:04:19 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame E09E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

39ms
38ms

Document
text/html

2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:31 GMT
expires: Fri, 28 Jul 2023 15:50:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:31 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame CBA9 6 KB
3 KB 17ms
16ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 20:41:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68959
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2551
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 28 Jul 2023 20:41:12 GMT

GET
H3 200 addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame CBA9 34 KB
13 KB 30ms
29ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 21:08:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67335
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 28 Jul 2023 21:08:16 GMT

GET
H3 200 0e7ab5bc7d0832bf36a59880c5de4188.js
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/ Frame CBA9 102 KB
29 KB 19ms
17ms Script
application/x-javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/0e7ab5bc7d0832bf36a59880c5de4188.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 27 Jul 2023 13:04:09 GMT
age: 96382
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30079
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 13:04:09 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0CF5 0
0 47ms
44ms Image
text/html 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202307260102&jk=1525505719642836&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:806::2002 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 49ff33a666fe618194d696393c4ced54.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/ Frame CBA9 43 KB
43 KB 18ms
17ms Image
image/jpeg 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/49ff33a666fe618194d696393c4ced54.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 24 Jul 2023 13:12:35 GMT
x-content-type-options: nosniff
age: 355076
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43891
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 23 Jul 2024 13:12:35 GMT

GET
H3 200 53664df03ef81c39eabc60dedd14ee36.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/ Frame CBA9 4 KB
5 KB 34ms
34ms Image
image/png 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/53664df03ef81c39eabc60dedd14ee36.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Thu, 27 Jul 2023 13:04:09 GMT
x-content-type-options: nosniff
age: 96382
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4600
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 13:04:09 GMT

GET
H3 200 trajan_pro_400_normal.ttf
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/fonts/ Frame CBA9 67 KB
44 KB 52ms
16ms Font
font/ttf 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/fonts/trajan_pro_400_normal.ttf

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: null
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 27 Jul 2023 13:04:09 GMT
age: 96382
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44537
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 13:04:09 GMT

GET
H3 200 trade_gothic_lt_std_702_normal.ttf
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/fonts/ Frame CBA9 26 KB
14 KB 48ms
13ms Font
font/ttf 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/fonts/trade_gothic_lt_std_702_normal.ttf

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: null
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 24 Jul 2023 13:12:35 GMT
age: 355076
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14620
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 23 Jul 2024 13:12:35 GMT

GET
H3 200 49ff33a666fe618194d696393c4ced54.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/ Frame CBA9 43 KB
43 KB 14ms
14ms Image
image/jpeg 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/49ff33a666fe618194d696393c4ced54.jpg

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 24 Jul 2023 13:12:35 GMT
x-content-type-options: nosniff
age: 355076
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43891
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 23 Jul 2024 13:12:35 GMT

GET
H3 200 53664df03ef81c39eabc60dedd14ee36.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/ Frame CBA9 4 KB
5 KB 20ms
19ms Image
image/png 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18247533069586716790/media/53664df03ef81c39eabc60dedd14ee36.png

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Thu, 27 Jul 2023 13:04:09 GMT
x-content-type-options: nosniff
age: 96382
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4600
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jul 2024 13:04:09 GMT

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js
pagead2.googlesyndication.com/bg/ Frame CBA9 37 KB
14 KB 13ms
12ms Script
text/javascript 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 21:04:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 153972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 21:04:19 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame BA15 0
0 62ms
61ms Image
text/html 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CsPXDxuPDZODgKdHFzwW2yJy4BcD_ld9xstCqgagRFBABIKqAwyJgycapi8Ck2A-gAdvVk-EDyAEJ4AIAqAMByANIqgSiAk_Ql8LexKG82ieGvPA6wBU91cy4vNxNAYySN_zIKNIsRoae6cDFNu----nhy-S684m1B9q08WtxwYGK2liUEBJTDOb5w_6RZK3ecy5DHg1OM14QodftU7Ja5N_kpGYA8xnbyU2IZaC2b4SJTVqE8EFDefhDHKI7yiQ1HQgMN9k7d4_mt_kWQmuWsMK_hCMrJErZDGTXKwppI77RVcn6RCB8xBemRQNpD7dSV8rhAjsSLGTUyq9kxoIrALpugy56pMMvLoRH1kJKw2sz5x1TYG8vx-eElQB7IOW9A1Ge9sstmb42I6ODIBICae6xYjeHl04fdhvIqcyQIMmfGgivqcfOL3BwjujASxVi9jrVGWCiS7FiXzdeFXEvnYkI-9Dp_HYCwATJ5KOK9AHgBAGSBQQIBBgBkgUECAUYBKAGLoAHjarsHqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEMKtBtIIFAiAYRABGB0yAooCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0zMzE0MzMxNTI4MDg1MzY5gAoDyAsB2BMC0BUBgBcBshceChwIABIUcHViLTIzODIwMTI1MjI5NzkxMDgYku8h&sigh=PBRE9nAKGxI&uach_m=[UACH]&cid=CAQSSwBpAlJWk7eQ71Vd_Oa5AeeJU-rLDMVu4fhBHMKmqgo1SOVxUWueuk9M7yXkz5M5VgWEZW2ROYRTkN-WCejFQSWaQvgVXxEeYC0jUxgB&template_id=419&cbvp=2&vis=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:805::2002 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0629 0
10 B 21ms
20ms Image
text/plain 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Ko4z2w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2001 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:32 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 container.html
3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 09DC 6 KB
3 KB 18ms
15ms Document
text/html 2607:f8b0:4020:806::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:30 GMT
expires: Sat, 27 Jul 2024 15:50:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame FDC0 624 B
245 B 50ms
47ms Document
text/html 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhC9m-bYAhj5joDxATAB&v=APEucNX42Ajo3RC8QYSjDHjhHKF-pTL1tW6KIrq1Fa2ZNrPMHZDIkLDdvR2ML9KrGbW2RcJkt5njTWpOs1-jUstr7YkoiTdSgg

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:32 GMT
expires: Fri, 28 Jul 2023 15:50:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js
pagead2.googlesyndication.com/pagead/js/ Frame 09DC 85 KB
29 KB 128ms
127ms Script
text/javascript 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 28 Jul 2023 15:50:32 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 09DC 42 B
63 B 45ms
41ms Image
image/gif 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dq9Og5aP1Wl1jZMOF9O6aIHOa8XNK2FdSeirJa4-2S_Dvwd-GrNLcl2nFYZm7pvgxC4sQlnn61YHF0cr-vhzHR1_euetqd2QA6X_sQZ7wCm_7qrGE

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 09DC 0
20 B 45ms
42ms Image
image/gif 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=551068465862857758&x=1&ct=76

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame 09DC 3 KB
1 KB 15ms
12ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61266
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H3 200 qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame 09DC 20 KB
8 KB 16ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61266
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H2 200 rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 09DC 179 KB
56 KB 47ms
44ms Script
text/javascript 2607:f8b0:4020:807::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 28 Jul 2023 15:50:32 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 09DC 0
20 B 42ms
41ms Ping
image/gif 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5712372892215&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 09DC 0
20 B 44ms
43ms Ping
image/gif 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5712372892215&version=m202306200101&ct=76&x=1&cor=551068465862857700

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad
googleads.g.doubleclick.net/dbm/ Frame 09DC 77 KB
36 KB 83ms
82ms Script
text/javascript 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A01o0gFGZZq3crrAzzVDapvOokEK_9iIafE5Wad_D5-MFa2ZXsMxdksCDm9LbXQWKaYZT2h5Xa3KU2xETl32jzv2Jhvw&cry=1&dbm_d=AKAmf-AjbMJR4PTfBf4fd1_aE9QNDmPfdnJVRna6mLcw6lFLpZGIYhDi1u7RD4oShA5Z9hYR2yndy_2gXa8zO7OoNz3e4PHceDqeRbcaDdfcLNM70Kx4BWH34MTea1-m6DHPW7jq2OvErJMQCRQnmyhcdMCNJH7KgHI9RpQNZAtjcB6HOOB9VcWoyBa4-b-NrgTbgLtNKjDWNmIxxo7CC6rvzfhhQiMQrODvvhDZDX-j7igVmHx1tE2jAOizyhNvP2ztkjXJlEB5DVz5fZnAneMqpAvW2ngPfE68x60Rgw4hpsTGUmDpFELBAw8DInvtB4ACPPe5a3gulll93PvoWcE1tWNlftsNqTEqDohQARY2YOF2iBhSs2hUThYNg91KjRiuH1vzUjhtU2kWJ0w1Zu6MQqjoFpO0FeMuwQgeQipxrGMEp-u9S7ROpGYVMoesWHoMuHIr-q-N6WALBEA8Otuy2J57hFOKDPaPRP9DLVKrdOu1MYQpBplGE9DbJyFMuARgilZoYub9ruOI96jkMUk_LKROqr5-J3haoOa4q3yCYGkWVu7mPFBB3hOC1f-gauCZGWCkTHPJb3APQM-t65STmkGSBNPeOPv7EpuAEOw94oYm8K86F2AWD2Ey5rgepp-RcGYsVijD3cmzzuMX1nK3Pu7ycYtPZdH7wLi8qtVvcTrhHmDXXAmfrUzta-zy6ewO_xd850uG0Y4hOY1XP6z8c5Iop5TOGKkUvNDxV46L-1ZXIg7VQye_RjdcNkNURU7qJONjt0GOgSUmOqNN5RCveZBYkDmZQsO700f1j_6pL_qkyPzqwRGpIjyiMX4e_kj6VIKWjfkkZFR6mCRZyH4wsuO4v2PSWEx2M3XJy5z8z4vE-TXyHzG67qVwlbLqwj2wXHbXt101793f_jR7_A-scKd9RGjAbdNCdI4k9J5xdjNZbleT3ykB4B1rKnVcG_Yns9YaGjWziRWVnRnOgS-VJml1brhrMK8-NYhXR7NN1qLWziD0Pd2B_LUV1Uw7qTW8IzUqk_OMN2Hv-GPZ-BExyR7o5bbzMPFGBRvjEJcE05tujvihh0BKgEbxWRgOdtAK-Q2psDjqUizF8NMWva4aY9OnyWGU0x5Nm9nI28Ics4WrS_q0RsB6fRCs7iUzovjiq1CKJIdZJJOC1yuuU1eWS-gwCyOVshnz7yeCE2zp1fuYeMkGFFCP6rU6wUYC5uU9O8ZAQuuk2shxJO_JS2qH6aVwwmTHE0NoqU1EnmpW4Oqe4W2DI9MDN7AV-WfYVdgzE48oMuBkozppx3xh-SrCc6C4nk6QlH2LFAHwoZGxGGiLJaZYt9HXGhPJfZg_GKjqTloU7XuiiIdVFglSdg1rtU0CLpLSw9XNz0CyJRKMNSrk9h9C_ImcPJrSbfu8YWmUKvvsjtahx0vdqWtYZ16mzlPQr_5RDIEf_ork3RcdMrFtNNKM1gT4QYCfcASvN53qQsRfy8tp0SHi8hf33oJbu_r3RK-SxYlwjHXeP0AHS_c5MGk97QSeqRiRwIJ-BZQSrcs4TsIBD_iiLy7S3PyvJx4ZSkvSLyMQ7uP6ym-qspBM-T5yC1KODcgSWMwi4dXeV29QwnDDIeRx7-cOTfeYndA38OnWprbj8KNrucngsZeMXrayHA8__QDTb33HQL1jhCGxE9owbWR9v1htxt4dtblQsCmqCi2uOCme-pTEwXYBjyzfSg_oGkGgdwQjMs1rVRRBbEhSWeFGtuqeegEz_wAhQbLPxI122dJR3JXhDCvzv6oFOGmtTwSbVHitSxZEXUZLpWD13veLvz58Z1C8gr8r2hjxjT5k-cghbu6HYRkAuhB5z-zp8-tSQbv9oLVuMxqaQZ0SZKuEk3p8aYNAFjuG7mj1PbnR2asl9q8DeOpmuXKXis9GV9z7-_1-NoaFfqlvH8Lznci-8bax8hA5UKQ8OpXwWOIaJwg_1ylDcKfc8goz6fpmm3iL-gHozxwlivEA1_9ibdQUoIIJJIGxDwJQ4R2Y47ffxe6JHbmQUORRL46uMdPPdroIVrypOSPnLUOVyKp4ZdPk5LeZ24hcUPulxC3a2iU0ZkYcmyuH-NiE3SKsM1yygRV2nlxqxXUE0ZtYFI-QaR0aQWHeiHLI2Cc9rkAHz2MQ88KenT7BEZ--UR9V_4gb9Q0Dtcypvi_r2zB1MA-xb8scn_OX5T2R2gDLKmG_ihljauqlVMabxWtOLqKwF6UAUFqqD9vg2b-NS2RXZzloqYCMYD9raxfpIXc9Dk90UdqLF7zCtkfswc0TcyXCMWbUjY3OKn--m4sJa4o_WdByG66YGw8PJgDk8l5l4wWTqZMDZY9REg5LPiKp_i-9Tz-ShGJEiSOHcjojrFcyIhxdq5R1ZcIeef0QJdf7gQy6fzrEPcbUpUhFciPdbPfbpUj00_dYdta5g7LSRQR7tDK5W5p0mPHubqcvlbge0ObZCbKBYo4Ppr_dEqw1cN-qUqS-w_8uUBayGaG8sDl4Kn5o7zvcn_48Gzm9KWXo70q-2m5hwuAFzmqU-bGDn8F97dn0_u1fMtwMmoUMYwd8t6PgB57Uj94paf_cHQhjpsTriPWSBChqjKXopnzd1NYCCbSj8ifoOL7BjFbYiD2SsPv28HDqN5PlkfePdbZBmv9ZMxd7F6I_oElc_VlOB5YY9ruLVi9VrjmuivSztwfi7yOw7K2DmX2Ma3x-UUsU2iRGElMKyCCkJAMsOYqElzGG2zJuD7njx1sZKJoTmlAJ4f5HTXJx0ueA-0U4HL6ie8qYkMCdLdqyglJeo-xkfL9CqcK1k6LIb6aazn00eyBYNPZv_PJhGviebNjWbtr0-R6lVY6HW2Z50DVuE1xyNGGbYRF_JS7hJFx40nzAVUs3E2d2x65A8hUg7oflOckq0y02PjhJrV7PBtf9Gw0ZhsL42gbfz-VhI1hWUZ1JCJ6dPxSURJlcRe1XdnPVb4WsA7jUOi3qJqoFHz9uDgzb8JBKEsb-xVes9oqfKvJ6Tj3LCP2JYiBci5sWsXD-MfSItQbKwPbbQ-nlRjraQ1kWZYUa9NAY-kj4lrN4VAgn8sIbVPWD5-WLrD9NRMpUZwRiwb_n1TvQA8Kb9s0nfeJSO6EtJGlc5m9V2299eZ88lW835KfiuMVZynJX73jPZBRuv4mvyisNU2mA8pwQlEi_L4uD4ODwIThNl1W1r3E1vrrQAbdBu-U5ffUJRwjN2MgL65teTwtQcTvKgY1ZMdQSjuAuX6JnY0YGbOKHmY6rSg1sPNU9QdiM44C0wuWc3wBebeCkHzUju7rFjxkxpvn_HPDooyl34zo_TwB2Mx3QMrIji2nDOETZO5a_v-GMNLq8xFUVtd1E7Sm9M5ouQyTDSN01RGusjlrTxlZG2g9STx7OJa3wsHcYLK0gkQZVPuZ3ejAif9tYT4tnYArX8J4nFSvuyBVtyYr6F1ISGJDN0fnfsS79iniYCThzTteOVYf6nNSAPS4U0WdX3SXwzIMMDu_xkM1DD9K0B39FqimSqotzIXNHJfpD1RX6OfXYamNI0tbQhFMdxoeHPgUWOfAG2E4lqLmLs5RkktTkUe4xBvUAmtvUjj9YVoQSPjk0IniLFJvrdgSDOW1tRxMJaCS9bXN8tVkX5rhByTSxt1odkxMkKYDV-ixh9TO9Vu-HxYvDlqrYexsaZFH61cpnBlttt9mrJWsjEZGAj2xSbE5lKeOzZgkH&cid=CAQSSwBpAlJWfGe66OWQZgZZERhLJVfSGp7fPr1L_Ynxe9yZFX68FTO1zp4d1O3xEoIHqkj_38uIYTsBLJNeArV3FcF1zK8ZUxqIJ-RPFhgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fel7lwa.com%2F&ds=l&xdt=1&iif=1&cor=551068465862857700&adk=2857193498&idt=137&cac=0&dtd=18

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37043
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FDC0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1&C=1

43 B
766 B

5ms
4ms

Image
image/gif

192.40.39.223

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhC9m-bYAhj5joDxATAB&v=APEucNX42Ajo3RC8QYSjDHjhHKF-pTL1tW6KIrq1Fa2ZNrPMHZDIkLDdvR2ML9KrGbW2RcJkt5njTWpOs1-jUstr7YkoiTdSgg
Protocol: HTTP/1.1
Server: 192.40.39.223 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FDC0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZMPjyD-p5y5wi33PHb6MTAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1

43 B
766 B

25ms
13ms

Image
image/gif

192.40.39.223

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhC9m-bYAhj5joDxATAB&v=APEucNX42Ajo3RC8QYSjDHjhHKF-pTL1tW6KIrq1Fa2ZNrPMHZDIkLDdvR2ML9KrGbW2RcJkt5njTWpOs1-jUstr7YkoiTdSgg
Protocol: HTTP/1.1
Server: 192.40.39.223 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Jul 2023 15:50:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMqm-jhdpiHzJvPJJIbr6ow&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame FDC0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFh5F7zLJVVwnrXykqpYEIs&google_cver=1

43 B
841 B

10ms
6ms

Image
image/gif

68.67.160.184

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFh5F7zLJVVwnrXykqpYEIs&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhC9m-bYAhj5joDxATAB&v=APEucNX42Ajo3RC8QYSjDHjhHKF-pTL1tW6KIrq1Fa2ZNrPMHZDIkLDdvR2ML9KrGbW2RcJkt5njTWpOs1-jUstr7YkoiTdSgg

Protocol

Server

68.67.160.184 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
an-x-request-uuid: 6bb0fc2d-56de-4605-92af-2a2c996a48e0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFh5F7zLJVVwnrXykqpYEIs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FDC0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTc2ODQ1NzY5NDY4MTUxNzM2MA%3D%3D

170 B
188 B

38ms
38ms

Image
image/png

172.217.13.98

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTc2ODQ1NzY5NDY4MTUxNzM2MA%3D%3D

Requested by

Protocol

Server

172.217.13.98 -, , ASN (),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 28 Jul 2023 15:50:32 GMT
an-x-request-uuid: d001d0b1-8874-4287-868d-b7c548bf524a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTc2ODQ1NzY5NDY4MTUxNzM2MA%3D%3D
x-proxy-origin: 5.181.234.134; 5.181.234.134; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/ Frame 09DC 30 KB
11 KB 16ms
14ms Script
text/javascript 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A01o0gFGZZq3crrAzzVDapvOokEK_9iIafE5Wad_D5-MFa2ZXsMxdksCDm9LbXQWKaYZT2h5Xa3KU2xETl32jzv2Jhvw&cry=1&dbm_d=AKAmf-AjbMJR4PTfBf4fd1_aE9QNDmPfdnJVRna6mLcw6lFLpZGIYhDi1u7RD4oShA5Z9hYR2yndy_2gXa8zO7OoNz3e4PHceDqeRbcaDdfcLNM70Kx4BWH34MTea1-m6DHPW7jq2OvErJMQCRQnmyhcdMCNJH7KgHI9RpQNZAtjcB6HOOB9VcWoyBa4-b-NrgTbgLtNKjDWNmIxxo7CC6rvzfhhQiMQrODvvhDZDX-j7igVmHx1tE2jAOizyhNvP2ztkjXJlEB5DVz5fZnAneMqpAvW2ngPfE68x60Rgw4hpsTGUmDpFELBAw8DInvtB4ACPPe5a3gulll93PvoWcE1tWNlftsNqTEqDohQARY2YOF2iBhSs2hUThYNg91KjRiuH1vzUjhtU2kWJ0w1Zu6MQqjoFpO0FeMuwQgeQipxrGMEp-u9S7ROpGYVMoesWHoMuHIr-q-N6WALBEA8Otuy2J57hFOKDPaPRP9DLVKrdOu1MYQpBplGE9DbJyFMuARgilZoYub9ruOI96jkMUk_LKROqr5-J3haoOa4q3yCYGkWVu7mPFBB3hOC1f-gauCZGWCkTHPJb3APQM-t65STmkGSBNPeOPv7EpuAEOw94oYm8K86F2AWD2Ey5rgepp-RcGYsVijD3cmzzuMX1nK3Pu7ycYtPZdH7wLi8qtVvcTrhHmDXXAmfrUzta-zy6ewO_xd850uG0Y4hOY1XP6z8c5Iop5TOGKkUvNDxV46L-1ZXIg7VQye_RjdcNkNURU7qJONjt0GOgSUmOqNN5RCveZBYkDmZQsO700f1j_6pL_qkyPzqwRGpIjyiMX4e_kj6VIKWjfkkZFR6mCRZyH4wsuO4v2PSWEx2M3XJy5z8z4vE-TXyHzG67qVwlbLqwj2wXHbXt101793f_jR7_A-scKd9RGjAbdNCdI4k9J5xdjNZbleT3ykB4B1rKnVcG_Yns9YaGjWziRWVnRnOgS-VJml1brhrMK8-NYhXR7NN1qLWziD0Pd2B_LUV1Uw7qTW8IzUqk_OMN2Hv-GPZ-BExyR7o5bbzMPFGBRvjEJcE05tujvihh0BKgEbxWRgOdtAK-Q2psDjqUizF8NMWva4aY9OnyWGU0x5Nm9nI28Ics4WrS_q0RsB6fRCs7iUzovjiq1CKJIdZJJOC1yuuU1eWS-gwCyOVshnz7yeCE2zp1fuYeMkGFFCP6rU6wUYC5uU9O8ZAQuuk2shxJO_JS2qH6aVwwmTHE0NoqU1EnmpW4Oqe4W2DI9MDN7AV-WfYVdgzE48oMuBkozppx3xh-SrCc6C4nk6QlH2LFAHwoZGxGGiLJaZYt9HXGhPJfZg_GKjqTloU7XuiiIdVFglSdg1rtU0CLpLSw9XNz0CyJRKMNSrk9h9C_ImcPJrSbfu8YWmUKvvsjtahx0vdqWtYZ16mzlPQr_5RDIEf_ork3RcdMrFtNNKM1gT4QYCfcASvN53qQsRfy8tp0SHi8hf33oJbu_r3RK-SxYlwjHXeP0AHS_c5MGk97QSeqRiRwIJ-BZQSrcs4TsIBD_iiLy7S3PyvJx4ZSkvSLyMQ7uP6ym-qspBM-T5yC1KODcgSWMwi4dXeV29QwnDDIeRx7-cOTfeYndA38OnWprbj8KNrucngsZeMXrayHA8__QDTb33HQL1jhCGxE9owbWR9v1htxt4dtblQsCmqCi2uOCme-pTEwXYBjyzfSg_oGkGgdwQjMs1rVRRBbEhSWeFGtuqeegEz_wAhQbLPxI122dJR3JXhDCvzv6oFOGmtTwSbVHitSxZEXUZLpWD13veLvz58Z1C8gr8r2hjxjT5k-cghbu6HYRkAuhB5z-zp8-tSQbv9oLVuMxqaQZ0SZKuEk3p8aYNAFjuG7mj1PbnR2asl9q8DeOpmuXKXis9GV9z7-_1-NoaFfqlvH8Lznci-8bax8hA5UKQ8OpXwWOIaJwg_1ylDcKfc8goz6fpmm3iL-gHozxwlivEA1_9ibdQUoIIJJIGxDwJQ4R2Y47ffxe6JHbmQUORRL46uMdPPdroIVrypOSPnLUOVyKp4ZdPk5LeZ24hcUPulxC3a2iU0ZkYcmyuH-NiE3SKsM1yygRV2nlxqxXUE0ZtYFI-QaR0aQWHeiHLI2Cc9rkAHz2MQ88KenT7BEZ--UR9V_4gb9Q0Dtcypvi_r2zB1MA-xb8scn_OX5T2R2gDLKmG_ihljauqlVMabxWtOLqKwF6UAUFqqD9vg2b-NS2RXZzloqYCMYD9raxfpIXc9Dk90UdqLF7zCtkfswc0TcyXCMWbUjY3OKn--m4sJa4o_WdByG66YGw8PJgDk8l5l4wWTqZMDZY9REg5LPiKp_i-9Tz-ShGJEiSOHcjojrFcyIhxdq5R1ZcIeef0QJdf7gQy6fzrEPcbUpUhFciPdbPfbpUj00_dYdta5g7LSRQR7tDK5W5p0mPHubqcvlbge0ObZCbKBYo4Ppr_dEqw1cN-qUqS-w_8uUBayGaG8sDl4Kn5o7zvcn_48Gzm9KWXo70q-2m5hwuAFzmqU-bGDn8F97dn0_u1fMtwMmoUMYwd8t6PgB57Uj94paf_cHQhjpsTriPWSBChqjKXopnzd1NYCCbSj8ifoOL7BjFbYiD2SsPv28HDqN5PlkfePdbZBmv9ZMxd7F6I_oElc_VlOB5YY9ruLVi9VrjmuivSztwfi7yOw7K2DmX2Ma3x-UUsU2iRGElMKyCCkJAMsOYqElzGG2zJuD7njx1sZKJoTmlAJ4f5HTXJx0ueA-0U4HL6ie8qYkMCdLdqyglJeo-xkfL9CqcK1k6LIb6aazn00eyBYNPZv_PJhGviebNjWbtr0-R6lVY6HW2Z50DVuE1xyNGGbYRF_JS7hJFx40nzAVUs3E2d2x65A8hUg7oflOckq0y02PjhJrV7PBtf9Gw0ZhsL42gbfz-VhI1hWUZ1JCJ6dPxSURJlcRe1XdnPVb4WsA7jUOi3qJqoFHz9uDgzb8JBKEsb-xVes9oqfKvJ6Tj3LCP2JYiBci5sWsXD-MfSItQbKwPbbQ-nlRjraQ1kWZYUa9NAY-kj4lrN4VAgn8sIbVPWD5-WLrD9NRMpUZwRiwb_n1TvQA8Kb9s0nfeJSO6EtJGlc5m9V2299eZ88lW835KfiuMVZynJX73jPZBRuv4mvyisNU2mA8pwQlEi_L4uD4ODwIThNl1W1r3E1vrrQAbdBu-U5ffUJRwjN2MgL65teTwtQcTvKgY1ZMdQSjuAuX6JnY0YGbOKHmY6rSg1sPNU9QdiM44C0wuWc3wBebeCkHzUju7rFjxkxpvn_HPDooyl34zo_TwB2Mx3QMrIji2nDOETZO5a_v-GMNLq8xFUVtd1E7Sm9M5ouQyTDSN01RGusjlrTxlZG2g9STx7OJa3wsHcYLK0gkQZVPuZ3ejAif9tYT4tnYArX8J4nFSvuyBVtyYr6F1ISGJDN0fnfsS79iniYCThzTteOVYf6nNSAPS4U0WdX3SXwzIMMDu_xkM1DD9K0B39FqimSqotzIXNHJfpD1RX6OfXYamNI0tbQhFMdxoeHPgUWOfAG2E4lqLmLs5RkktTkUe4xBvUAmtvUjj9YVoQSPjk0IniLFJvrdgSDOW1tRxMJaCS9bXN8tVkX5rhByTSxt1odkxMkKYDV-ixh9TO9Vu-HxYvDlqrYexsaZFH61cpnBlttt9mrJWsjEZGAj2xSbE5lKeOzZgkH&cid=CAQSSwBpAlJWfGe66OWQZgZZERhLJVfSGp7fPr1L_Ynxe9yZFX68FTO1zp4d1O3xEoIHqkj_38uIYTsBLJNeArV3FcF1zK8ZUxqIJ-RPFhgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fel7lwa.com%2F&ds=l&xdt=1&iif=1&cor=551068465862857700&adk=2857193498&idt=137&cac=0&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 00:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54570
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 11 Aug 2023 00:41:02 GMT

GET
H3 200 omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/ Frame 09DC 11 KB
4 KB 16ms
15ms Script
text/javascript 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 00:01:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56967
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 11 Aug 2023 00:01:05 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 09DC 0
0 142ms
63ms Fetch
image/gif 172.217.13.130

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstcb1pQG6o9uXec54IdKpYdf5dLQSNpdPVbGCGGQ6S6pB2uMBfvJd6hQwWFuMfVnnN4zXZAwbX4_0KtsPTR3AzgFQrfO9KOEmjGXZvAwJUGdFvCgAjjVRF-xFm-gSlxiSpbims8WT1zyPV8shNJSM_qTXB1bhKUGxIo-KKA-IMZE8jnXeFEfqG2DZ-QpgksMI0EGFKe0iUwJAu_C_AXYSsCBg8yxhVT7bv5G322jZohTmjH1Cqew3erWqENWmqTFuzdzdAYj8TYt_ee75p2K8tzCZ08fE0HMX5OFffp2-ytdK1XH0k5OdkWW87XMw_Ooyiep9fDULfCqWHHTeBrT8Ks2Qurt-R_gdDEgAZYmDXhonB-nuXRYvsOneaqPH1E35-iiGxFHK8ZblxhxL_-yut8pjIL3sv38NFqdz4SuaHtYOUfafIKIXlW6r-JlH0lA9_F8dVH7AWNnq5rvaMgZ_3TaDm833cEdtwEVxAEk1_RAITR5J2B7aV5Zkjq2_dBBxFX07jz0BcUVjctcR5WIpSJWjZqgdU2Ul4P1FdNyw845YSwCtrodX4dAgrDHvH1AgoGnZnzBgTCO4FKCuSlz0DqYEwv3bhVwWbwWyM5JOaTrps_M8RyWv5uKC-F1McJwKp2rshI5LPS0Q6LalWMHx4OgDwhDOujORQxfwtl95y89LQQd2NVkYR07s0VR9QTqX8I4wo7q5W8963Rkxi3oSlOnycdVtb3e2aLwhFjftnUCdHnR2Lm0sA26Z7KjnxH5m_RL1Olzj48dEUxC8fbCaTGBXlZrowHDJ6w_323x9dqcAu_qRinLqeQSoBkmiMq5BHfRZ1YKTK72Jw3TlLU_Tcq97WNjnwL2Z2AfEW-t2243__Hk2DXaEgCclpYE0_5ZtB02qbcl36w3BYnYLEoSXtmlnombS0iB_ye_CDx0PXA25aUhX_zbcex0ogFgBPXVZDFfCgPDOMuWZpiPnwM5yejkTVUKeUX-L6nkPlxwuFtM8bUwCMgAGL5PKrEoKcP8X7n81CiT5Bj0yFvsNF2ZKBwqR3KsDTH6zXmYe4VVN5MaxjVPZ4_xH367sHrLccyIYw88wq8nLkZ-HLglQTR_uAKeBFoT3-InoHseCwQ7wYlQwinpZEYXEfRG1gOGeto92Bi6VFbk7Tl4lz99jPFvex1KjzeqayjfCP9yXgwg79kKOzAuwnfZTueVKLYKoJYry_VIjQq9ZsLI_1c3l3qg5I3WucB6ycx15oMHon5RCCFmKMdDNT7rd9jMXeMxTOCZ6U7cNvQLaHJgt3wDNXdZxawIqS_TSX0KPAi2r3l0J65prlORcl5cLYI1AqLZ3VQ95EEJ6Y91S-ppZoQ_cbHOJO7ej6L&sai=AMfl-YSx3JWkJ0FyiwcX4wWk0bbfhEQAFCVNRHOsm74MtINKY5_AxoNVQKmXwR1Z7dL3pWEw_CPHkXVP36mDRTW0JT5ggMOmypJvg53j_M23XzFrSPp5qE1RNujymkn8ExSvunAOb0rLzUSMWivAn6ibLYWVA2LaaIR-ZRayJ57l7uYhR5KAMnntH9AgDG1oBBZ8Dc_qwMaKMXoYhLzKLj8jf-roasbJfhxaPSobFwV_uA_3h0ono2uLhNlPfqqMT_YAWhVdebYhf3e-towkWEk6Xz4HME5ccKG1&sig=Cg0ArKJSzGxOcZF-e_uxEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230726.21433&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 28 Jul 2023 15:50:32 GMT

GET
H3 200 UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 09DC 41 KB
13 KB 14ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 20:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155484
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jul 2024 20:39:08 GMT

GET
H2 200 1813893670911090031
s0.2mdn.net/simgad/ Frame 09DC 40 KB
41 KB 74ms
13ms Image
image/jpeg 2607:f8b0:4020:807::2006

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/1813893670911090031

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 21:03:16 GMT
x-content-type-options: nosniff
age: 154036
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41114
x-xss-protection: 0
last-modified: Mon, 17 Jul 2023 18:43:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 25 Jul 2024 21:03:16 GMT

GET
DATA 200
OK truncated
/ Frame 09DC 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 1454 22 KB
8 KB 22ms
15ms Document
text/html 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 154278
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jul 2023 20:59:14 GMT
expires: Thu, 25 Jul 2024 20:59:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html
3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D78B 6 KB
3 KB 16ms
13ms Document
text/html 2607:f8b0:4020:806::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307260102/pubads_impl.js?cb=31076566

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://el7lwa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:30 GMT
expires: Sat, 27 Jul 2024 15:50:30 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 09DC 0
0 47ms
47ms Fetch
image/gif 172.217.13.130

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstcb1pQG6o9uXec54IdKpYdf5dLQSNpdPVbGCGGQ6S6pB2uMBfvJd6hQwWFuMfVnnN4zXZAwbX4_0KtsPTR3AzgFQrfO9KOEmjGXZvAwJUGdFvCgAjjVRF-xFm-gSlxiSpbims8WT1zyPV8shNJSM_qTXB1bhKUGxIo-KKA-IMZE8jnXeFEfqG2DZ-QpgksMI0EGFKe0iUwJAu_C_AXYSsCBg8yxhVT7bv5G322jZohTmjH1Cqew3erWqENWmqTFuzdzdAYj8TYt_ee75p2K8tzCZ08fE0HMX5OFffp2-ytdK1XH0k5OdkWW87XMw_Ooyiep9fDULfCqWHHTeBrT8Ks2Qurt-R_gdDEgAZYmDXhonB-nuXRYvsOneaqPH1E35-iiGxFHK8ZblxhxL_-yut8pjIL3sv38NFqdz4SuaHtYOUfafIKIXlW6r-JlH0lA9_F8dVH7AWNnq5rvaMgZ_3TaDm833cEdtwEVxAEk1_RAITR5J2B7aV5Zkjq2_dBBxFX07jz0BcUVjctcR5WIpSJWjZqgdU2Ul4P1FdNyw845YSwCtrodX4dAgrDHvH1AgoGnZnzBgTCO4FKCuSlz0DqYEwv3bhVwWbwWyM5JOaTrps_M8RyWv5uKC-F1McJwKp2rshI5LPS0Q6LalWMHx4OgDwhDOujORQxfwtl95y89LQQd2NVkYR07s0VR9QTqX8I4wo7q5W8963Rkxi3oSlOnycdVtb3e2aLwhFjftnUCdHnR2Lm0sA26Z7KjnxH5m_RL1Olzj48dEUxC8fbCaTGBXlZrowHDJ6w_323x9dqcAu_qRinLqeQSoBkmiMq5BHfRZ1YKTK72Jw3TlLU_Tcq97WNjnwL2Z2AfEW-t2243__Hk2DXaEgCclpYE0_5ZtB02qbcl36w3BYnYLEoSXtmlnombS0iB_ye_CDx0PXA25aUhX_zbcex0ogFgBPXVZDFfCgPDOMuWZpiPnwM5yejkTVUKeUX-L6nkPlxwuFtM8bUwCMgAGL5PKrEoKcP8X7n81CiT5Bj0yFvsNF2ZKBwqR3KsDTH6zXmYe4VVN5MaxjVPZ4_xH367sHrLccyIYw88wq8nLkZ-HLglQTR_uAKeBFoT3-InoHseCwQ7wYlQwinpZEYXEfRG1gOGeto92Bi6VFbk7Tl4lz99jPFvex1KjzeqayjfCP9yXgwg79kKOzAuwnfZTueVKLYKoJYry_VIjQq9ZsLI_1c3l3qg5I3WucB6ycx15oMHon5RCCFmKMdDNT7rd9jMXeMxTOCZ6U7cNvQLaHJgt3wDNXdZxawIqS_TSX0KPAi2r3l0J65prlORcl5cLYI1AqLZ3VQ95EEJ6Y91S-ppZoQ_cbHOJO7ej6L&sai=AMfl-YSx3JWkJ0FyiwcX4wWk0bbfhEQAFCVNRHOsm74MtINKY5_AxoNVQKmXwR1Z7dL3pWEw_CPHkXVP36mDRTW0JT5ggMOmypJvg53j_M23XzFrSPp5qE1RNujymkn8ExSvunAOb0rLzUSMWivAn6ibLYWVA2LaaIR-ZRayJ57l7uYhR5KAMnntH9AgDG1oBBZ8Dc_qwMaKMXoYhLzKLj8jf-roasbJfhxaPSobFwV_uA_3h0ono2uLhNlPfqqMT_YAWhVdebYhf3e-towkWEk6Xz4HME5ccKG1&sig=Cg0ArKJSzGxOcZF-e_uxEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=117&vt=11&dtpt=115&dett=2&cstd=0&cisv=r20230726.21433&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 28 Jul 2023 15:50:32 GMT

GET
H3 200 index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/ Frame 47A3 15 KB
4 KB 28ms
28ms Document
text/html 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Requested by

Host: spotify-online.cleverapps.io
URL: https://spotify-online.cleverapps.io/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 252416
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3789
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Jul 2023 17:43:36 GMT
expires: Wed, 24 Jul 2024 17:43:36 GMT
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/ Frame D78B 23 KB
9 KB 23ms
23ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/abg_lite_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61266
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H3 200 s
googleads.g.doubleclick.net/pagead/drt/ Frame D02C 143 B
166 B 24ms
22ms Document
text/html 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1737
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:21:35 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame D78B 3 KB
1 KB 23ms
22ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/window_focus_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61266
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H3 200 qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame D78B 20 KB
8 KB 24ms
24ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:49:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61266
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Aug 2023 22:49:26 GMT

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js
pagead2.googlesyndication.com/bg/ Frame 1454 37 KB
14 KB 16ms
14ms Script
text/javascript 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 21:04:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 153973
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jul 2024 21:04:19 GMT

GET
H3 200 exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 47A3 6 KB
3 KB 14ms
13ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 20:41:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68960
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2551
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 28 Jul 2023 20:41:12 GMT

GET
H3 200 addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 47A3 34 KB
13 KB 20ms
19ms Script
text/javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 21:08:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67336
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 28 Jul 2023 21:08:16 GMT

GET
H3 200 0e7ab5bc7d0832bf36a59880c5de4188.js
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/ Frame 47A3 102 KB
29 KB 50ms
49ms Script
application/x-javascript 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/0e7ab5bc7d0832bf36a59880c5de4188.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Fri, 28 Jul 2023 15:50:32 GMT
x-content-type-options: nosniff
content-encoding: gzip
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 27 Jul 2024 15:50:32 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 55ms
45ms Image
text/html 2607:f8b0:4020:806::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202307260102&jk=1525505719642836&bg=!sLOls-fNAAZGOVy5Zjk7ADkAdvg8WhqWSzorXlNmcVA6VDRi4MBgXD1_xE-hqy2cLj2Yp9S9gk0vwBKTIJYC1sIn5M4XUyHc2GkCAAAB_1IAAAAMaAEHCgBJVDrHRxuTBtdKdT_tI2_3wrqBHmcPuVWfzkwX1N6r8sZU9mMfsIJYAC45TmTIQyw3dEoYhMh_to_3nSooNn9xPtevcMZaA9BYBpkCoS6YK-Txt2GDy4buc1umfprWDzh_fvaNgSt6rcZ1o-sp3b3uskjNwXAAEy9wBxjggICkTFPg8y2cB3qPkXx9DprDAMJEwIrxS7T90eHd6cYU5f6r_i0LDLQzv4EFYkr_xAowcwa-uC3A5qQBRpt4QbBtu2RwMKHTEUOEpSWrIlz1pS5LEz7JJP9wuUaC8DMU1mEr53FnhDAYYu8ZmBiFNVwPSfzRDOJQBL4SH7arua3r4Zh7-s9Ji-IrdGmcjv3ZqGbx0MOevRQJeoCVtS3pqNHggVNUGiItXSI8pu3QnVFb-nu4gG-i3G8K1cgX3OFd74hmiYvp8ZTZNd_NyBxT6KcnpXOQ0nbgBglF9z1dMx6U6_mTPpp3XLGFdGGjlhPcMV0QQ6SssGtiEUWEXvNN2WJ2T1vI0wbctwaKIzkYj_0JE6NWru-jO32wBfI98T4qFUe_1iotjCpFZdWvWFjvXqKkeu6XZMWOsNlehQMvPwnm2fOqITywyf7OCKbhna_uwpLJZsw8psArHA33R8fG_R24Xl--x-9osEG5PS6MyO1FSLIchcRunEP-F7PwNpuvtBtmkVf6Op4P7rUT_ZmQUChOBkGJskFs2S7xkNNXEMEkPRL34iNH_TqcjANDgbA6KXX8eZPHVOsQbnOeemjJZPAzWXweQ-FJBD1BcIJEqMXfLl42jIO11Iml3wx5_yxJS_QjlYo2yp-kXoyf3zaxyQ4wkR7Jg1tx4YGiC2pVdnF67O7yTOibZsy3iVuJHu05JZk4PrDZxf2R8xK7pcShISFeRU9VDx3SlFheG56qasfeVGu25BYghUM_FPdjUFaEjvUF0QyNlGjM9whO0diBDwXbBGNd1fvoC_ejGNQD5H3K_8N5TO2uEpX3esjyEWihBBk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:806::2002 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://el7lwa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D78B 179 KB
56 KB 44ms
35ms Script
text/javascript 2607:f8b0:4020:807::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2002 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:50:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 28 Jul 2023 15:50:32 GMT

GET
DATA 200
OK truncated
/ Frame D78B 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame D02C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

41ms
40ms

Document
text/html

2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:32 GMT
expires: Fri, 28 Jul 2023 15:50:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 15:50:32 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 c97b687752412698da9d280f39703cc1.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/ Frame 47A3 22 KB
22 KB 18ms
17ms Image
image/jpeg 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/c97b687752412698da9d280f39703cc1.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 26 Jul 2023 22:13:40 GMT
x-content-type-options: nosniff
age: 149812
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22155
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 25 Jul 2024 22:13:40 GMT

GET
H3 200 5dd440c5c4ec711c29f23b1bc955e2cd.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/ Frame 47A3 3 KB
3 KB 22ms
21ms Image
image/png 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/5dd440c5c4ec711c29f23b1bc955e2cd.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Tue, 25 Jul 2023 17:43:37 GMT
x-content-type-options: nosniff
age: 252415
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3343
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 24 Jul 2024 17:43:37 GMT

GET
H3 200 trajan_pro_400_normal.ttf
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/fonts/ Frame 47A3 67 KB
44 KB 14ms
13ms Font
font/ttf 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/fonts/trajan_pro_400_normal.ttf

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: null
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 25 Jul 2023 17:43:37 GMT
age: 252415
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44537
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 24 Jul 2024 17:43:37 GMT

GET
H3 200 trade_gothic_lt_std_702_normal.ttf
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/fonts/ Frame 47A3 26 KB
14 KB 18ms
18ms Font
font/ttf 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/fonts/trade_gothic_lt_std_702_normal.ttf

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: null
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 25 Jul 2023 17:43:37 GMT
age: 252415
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14620
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 24 Jul 2024 17:43:37 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D78B 0
0 80ms
79ms Image
text/html 2607:f8b0:4020:805::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CN86OyOPDZNazBfPAoPwP8sydgAPA_5XfcYrQqoGoERQQASCqgMMiYMnGqYvApNgPoAHb1ZPhA8gBCeACAKgDAcgDSKoEqAJP0I9BdPejrLJkR1g2Y2Nxqx8Hob40FrSlAqFxPrH82DVU-4u3SsJW8lt6GaYbXxVHO3uy39CbE7vKEugldE3hMYs65ZxYVTZa6-0gwTCIgBdzmOSo8JZ_F2l1LRzSeqlCncsu-dCGvlOcAkMn8671uyhbNpi7Szp6EDhukic-CihTCM_Ujpmwpwamym9y4u8UDXQYiUXsNP-ada-0m2wfbsgqZYD47URcEMtqA6CXF_KeUqtYHBFRcBcbX6huJwSxP97EdvcvpCqTgzMy13GoIkYHh4-YYtdg2uaUMzfNXCtpqwP5OY7mDlyQVodhWZt5jMtmdIzjNfJjV1FtO1CymKTtwKpDoGctRguyr-i00MA0qpEnwiBN1Oy7h3CYwjXEaF8hzq9tb8AEyeSjivQB4AQBkgUECAQYAZIFBAgFGASgBi6AB42q7B6oB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCTygzSCBQIgGEQARgdMgKKAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzMxNDMzMTUyODA4NTM2OYAKA8gLAdgTAtAVAYAXAbIXHgocCAASFHB1Yi0yMzgyMDEyNTIyOTc5MTA4GJLvIQ&sigh=tB97gxX5Lwo&uach_m=[UACH]&cid=CAQSTABpAlJWv2DDlG5BSttfGf1y7S_7alECao9tmxGHq2f6UwDt92j-A8Coc3P5ezg-SafCoz12pGxPlM8NIVghQViFXqQikySm58BaVc0YAQ&template_id=419&cbvp=2&vis=1
Requested by: Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:805::2002 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 200 c97b687752412698da9d280f39703cc1.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/ Frame 47A3 22 KB
22 KB 18ms
17ms Image
image/jpeg 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/c97b687752412698da9d280f39703cc1.jpg

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 26 Jul 2023 22:13:40 GMT
x-content-type-options: nosniff
age: 149813
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22155
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 25 Jul 2024 22:13:40 GMT

GET
H3 200 5dd440c5c4ec711c29f23b1bc955e2cd.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/ Frame 47A3 3 KB
3 KB 19ms
18ms Image
image/png 2607:f8b0:4020:807::2001

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6757697843937859061/media/5dd440c5c4ec711c29f23b1bc955e2cd.png

Requested by

Host: 3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
URL: https://3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Tue, 25 Jul 2023 17:43:37 GMT
x-content-type-options: nosniff
age: 252416
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3343
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 15:46:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 24 Jul 2024 17:43:37 GMT

GET amp4ads-v0.mjs
cdn.ampproject.org/rtv/012307180709000/ Frame 716A 0
0

GET amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 716A 0
0

GET amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 716A 0
0

GET amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 716A 0
0

GET amp-form-0.1.mjs
cdn.ampproject.org/rtv/012307180709000/v0/ Frame 716A 0
0

GET css
fonts.googleapis.com/ Frame 716A 0
0

GET en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 716A 0
0

GET icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 716A 0
0

GET fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js
pagead2.googlesyndication.com/bg/ Frame 47A3 0
0

GET
DATA 200
OK truncated
/ Frame 716A 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: my.rtmark.net
URL: https://my.rtmark.net/img.gif?f=merge&userId=7db593e5cf9847d3b75f5b7d366ed5dc

Domain: prebid.smilewanted.com
URL: https://prebid.smilewanted.com/

Domain: prebid.smilewanted.com
URL: https://prebid.smilewanted.com/

Domain: prebid.smilewanted.com
URL: https://prebid.smilewanted.com/

Domain: prebid.smilewanted.com
URL: https://prebid.smilewanted.com/

Domain: prebid.smilewanted.com
URL: https://prebid.smilewanted.com/

Domain: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1525505719642836&correlator=3519215692106670&eid=31076566&output=ldjh&gdfp_req=1&vrg=202307260102&ptt=17&impl=fif&iu_parts=121764058%3A22350065965%2Cel7lwa.com%2Cel7lwa.com_adi_ATF&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x250%7C970x90%7C750x200%7C728x90&ifi=5&adks=88463683&didk=3581314068&sfv=1-0-40&prev_scp=hb_format_criteo%3Dbanner%26hb_size_criteo%3D728x90%26hb_pb_criteo%3D0.12%26hb_adid_criteo%3D11137298f37801bd%26hb_bidder_criteo%3Dcriteo%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.12%26hb_adid%3D11137298f37801bd%26hb_bidder%3Dcriteo&sc=1&cookie_enabled=1&abxe=1&dt=1690559430867&lmt=1690559430&adxs=315&adys=251&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=26&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fel7lwa.com%2Fdegree%2Ftop-10-degrees-in-demand-for-2021%2F&ref=https%3A%2F%2Ft.co%2F&frm=20&vis=1&psz=0x-1&msz=970x-1&fws=640&ohw=0&ga_vid=364975040.1690559430&ga_sid=1690559431&ga_hid=712039511&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABjEgMfpmTFIABIZCgpwdWJjaWQub3JnGIP-xumZMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRi6_MbpmTFIAFICCGQSFwoIcnRiaG91c2UYu_zG6ZkxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVZWUkJaREZLTW5aU01VTlVTWHBOUlcwMU9ISlJkejA5SW4wPRj9gMfpmTFIABIZCgp1aWRhcGkuY29tGLr8xumZMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yu_zG6ZkxSABSAghk&dlt=1690559428871&idt=1286

Domain: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/amp4ads-v0.mjs

Domain: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/v0/amp-ad-exit-0.1.mjs

Domain: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/v0/amp-analytics-0.1.mjs

Domain: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/v0/amp-fit-text-0.1.mjs

Domain: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012307180709000/v0/amp-form-0.1.mjs

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Verdicts & Comments Add Verdict or Comment

178 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
grunoaph.net/	1970-01-20 22:21:35	Name: OAID Value: 7db593e5cf9847d3b75f5b7d366ed5dc
grunoaph.net/	1970-01-20 22:21:35	Name: oaidts Value: 1690559426
jokekroako.com/	1970-01-20 22:21:35	Name: OAID Value: 6ff1b16238f7a9758d671ed24bbfb829
jokekroako.com/	1970-01-20 22:21:35	Name: oaidts Value: 1690559426
my.rtmark.net/	1970-01-20 22:21:35	Name: ID Value: 6ff1b16238f7a9758d671ed24bbfb829
jokekroako.com/	1970-01-20 23:11:59	Name: syncedCookie Value: true
jokekroako.com/	1970-01-20 13:36:03	Name: reverse Value: QUm16R1A1qzZIgulLrZp4YuuBlELVFv7OOYOEJxH9_c
jokekroako.com/	1970-01-20 13:35:59	Name: prefetchAd_4662728 Value: true
.t.co/	1970-01-20 23:11:59	Name: muc Value: 4866477a-d15e-47ae-9ce4-553e227d3c96
.t.co/	1970-01-20 23:11:59	Name: muc_ads Value: 4866477a-d15e-47ae-9ce4-553e227d3c96
el7lwa.com/	1970-01-20 13:46:04	Name: __oagr Value: true
.el7lwa.com/	1970-01-20 23:11:59	Name: _ga_TQQXHHMPP3 Value: GS1.1.1690559429.1.0.1690559429.0.0.0
.el7lwa.com/	1970-01-20 23:11:59	Name: _ga Value: GA1.1.364975040.1690559430
el7lwa.com/	1970-01-20 14:19:11	Name: _pbjs_userid_consent_data Value: 6683316680106290
.el7lwa.com/	1970-01-20 22:21:35	Name: _sharedID Value: 4e16c114-c8c1-4c98-9ebd-2b6354f3e377
.a-mo.net/	1970-01-20 22:21:35	Name: amuid2 Value: 11865bdf-739f-44ff-9494-547a30672151
.prebid.a-mo.net/	1970-01-20 22:21:35	Name: sd_amuid2 Value: 11865bdf-739f-44ff-9494-547a30672151
.quantumdex.io/	1970-01-20 14:19:11	Name: uid Value: 6d29f029-1a35-47a2-b6ef-5cc6e39378d0
.criteo.com/	1970-01-20 22:57:35	Name: uid Value: 802fde7b-c136-4653-850a-7e396cea2303
.openx.net/	1970-01-20 22:21:35	Name: i Value: 51301dd4-9daf-4750-9323-33049b9f2b43\|1690559430
.crwdcntrl.net/	1970-01-20 20:04:44	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-20 20:04:44	Name: _cc_id Value: 23c180390a4059a3eed32fc8a66c1d6
.prebid.a-mo.net/	1970-01-20 22:21:35	Name: __amc Value: 3_1690559429_1690559430
.el7lwa.com/	1970-01-20 20:04:47	Name: _cc_id Value: 23c180390a4059a3eed32fc8a66c1d6
.el7lwa.com/	1970-01-20 13:37:25	Name: panoramaId_expiry Value: 1690645830498

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ Message: Access to XMLHttpRequest at 'https://prebid.smilewanted.com/' from origin 'https://el7lwa.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prebid.smilewanted.com/ Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ Message: Access to XMLHttpRequest at 'https://prebid.smilewanted.com/' from origin 'https://el7lwa.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prebid.smilewanted.com/ Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ Message: Access to XMLHttpRequest at 'https://prebid.smilewanted.com/' from origin 'https://el7lwa.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prebid.smilewanted.com/ Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ Message: Access to XMLHttpRequest at 'https://prebid.smilewanted.com/' from origin 'https://el7lwa.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prebid.smilewanted.com/ Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://el7lwa.com/degree/top-10-degrees-in-demand-for-2021/ Message: Access to XMLHttpRequest at 'https://prebid.smilewanted.com/' from origin 'https://el7lwa.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prebid.smilewanted.com/ Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3f9805ddb0fea359139e2a9f0ca75562.safeframe.googlesyndication.com
bcp.crwdcntrl.net
bidder.criteo.com
cdn.ampproject.org
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.prod.uidapi.com
cm.g.doubleclick.net
cmp.optad360.io
dsum-sec.casalemedia.com
el7lwa.com
esp.rtbhouse.com
fonts.googleapis.com
fonts.gstatic.com
get.optad360.io
ghb.adtelligent.com
ghb1.adtelligent.com
ghb2.adtelligent.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
grunoaph.net
gum.criteo.com
ib.adnxs.com
id5-sync.com
invstatic101.creativecdn.com
jokekroako.com
match.adsrvr.org
mug.criteo.com
my.rtmark.net
oa.openxcdn.net
oajs.openx.net
onetag-sys.com
optad360.mgr.consensu.org
pagead2.googlesyndication.com
pr-bh.ybp.yahoo.com
prebid-eu.creativecdn.com
prebid.a-mo.net
prebid.smilewanted.com
rtb.adxpremium.services
s.amazon-adsystem.com
s0.2mdn.net
secure.gravatar.com
securepubads.g.doubleclick.net
spotify-online.cleverapps.io
ssp.wp.pl
static.criteo.net
t.co
tags.crwdcntrl.net
tpc.googlesyndication.com
us-u.openx.net
useast.quantumdex.io
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
cdn.ampproject.org
fonts.googleapis.com
my.rtmark.net
pagead2.googlesyndication.com
prebid.smilewanted.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
104.244.42.5
13.249.190.38
139.45.195.8
139.45.197.238
141.95.33.111
147.75.195.77
172.217.13.130
172.217.13.98
172.64.167.17
18.161.21.99
185.106.140.18
185.184.8.90
185.42.117.192
192.40.39.223
2001:4860:4802:34::178
209.54.182.161
212.77.99.29
23.227.137.154
2600:1f18:4e9:5a01:b943:7cee:b004:871e
2600:9000:20ee:9a00:6:b871:4f00:93a1
2600:9000:24eb:4e00:11:a4de:2580:93a1
2600:9000:26dc:3e00:a:e047:753:be1
2606:4700:10::6816:2560
2606:4700:10::ac43:266a
2606:4700:3031::6815:4dda
2607:f8b0:4020:805::2002
2607:f8b0:4020:805::200a
2607:f8b0:4020:806::2001
2607:f8b0:4020:806::2002
2607:f8b0:4020:806::2003
2607:f8b0:4020:806::2008
2607:f8b0:4020:807::2001
2607:f8b0:4020:807::2002
2607:f8b0:4020:807::2004
2607:f8b0:4020:807::2006
2620:100:a001::18
2620:100:a001::4
2620:100:a001::c
2a04:4e42:400::485
2a04:fa87:fffe::c000:4902
2a06:8640:454:0:e082:abff:fefe:d1d2
34.102.146.192
34.120.135.53
34.206.201.46
34.96.70.87
35.190.39.111
35.244.159.8
51.222.39.184
52.223.40.198
68.67.160.184
74.119.119.139
029d6f388a42f0beb6191c9a2f38b10fcb60bda49d49468b480b26a55961da11
0595a4aaeb983c9d5f9c976475c5f5e892564ddf376413dda175681f5bca16e9
128f76df591e53bde9def0aac6966f056566a6f46a80cc9dc7a8e0402520bd22
154523c0e4bb54705a3073619d1abcdf13d25cb6a26850d03907bf1d3d060ee6
18969e46c2396817023dd164102834e504a662d137b79f12f604f3638ab87ebf
1c54b9d1b579c59f8245fd21a021725c0dbde06ec90f44df1bbc03458f40dfe8
1d52889bf70782f23e5b1c22cb1bd2f60a044bf9aaa979733ddfeaa43d761273
1f6ab3365e9b4257d5fc5e14b7fb19a2a6eb287db89e6f573bd881bccfa59052
1fe6c670986cf69f0a5db5bdb7f2d2cbca3a548339dcb820597f924f048d658e
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2654cffb7bc20d85b2c1eff65bf42556b00595473b2279dd37ebe1c7068b8179
29fef76cb9373bfc0dc79998458488d01a3e5fc630a1cb383b8ee4e6c21851d0
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2d3660f045d3d7331eca69b438f8dc351ed05b6f1551cfcf74f5cd6c446ed24d
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44f62e506bc0795f05f1be751e6db40d5f7a5f64af70a791c7735bfd07bae187
4924e12a30059184d9bd1c36294dcdf957f5f2da452209448b35a93aa785cca5
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
538638ff5898160cb711d661e61eebd3d9d92042962e50310a0cc9c38da05aff
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
56c09cdddbb52eff660021ca91896cde47f956f91be4b43601d8224873bdcbcc
5991417faf110c766a11f0392ed46de4adb3eba8ad9e3d9b75a06460c44b93a9
60a38262577d08663ee6886935bbfd57c1f4547b4c778188ade7405853788504
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
7c6f20129d94108a41c0c098d0d43d345c673f8b43855e2329c169a2029b9b8b
8716acb5313a21804b90a7ebfe9097ac03f77318040bfaca3adc9ca7c3574053
89cdf50daef9e296f56cdf7232fb7993bee7d17bb4c21ad89388191d2fc38446
8c3bf17f943508b7d6ea95e60395c283f94cc61c2113df2721a4892b22affe75
8fe55260ff38a5b43c17e07465097fa5821d6376241ac60f22411b3d36579653
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
95785ffb91b3577eabc72dc0dd0f79029c7a822c6edd16d495a57c3e94b3cd20
96d69c07de6945a7f3b199641074634c0b3a6271ddf0f360acc93b113666f797
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
99e4b842bdd8f0f126d8433a53858582506ca16e58c23cb7669bb03607a3049f
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
aecbcd81ab4ba067ecfc856682cb5d34b2249db6564ae0e4f3f23422b734dc31
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
afb72cd01000ff280894580cf3cffa702e5cd05b3461e4290cfe34c651a57318
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b0b0742e61062626033382699d7aea07a9f12590f16dd70c8c4a09b2787729bc
b118568858df50612fa3591132d6d6bb41ddf00f8c74ad8cccd16e5510691aad
b758f1339a9633530f995b11ea8edf75405d1344cab80e27a060fba2bf02830e
b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7
badba5d0fd7389ca5e2025cc0d130a37ab6aa96ed709fc0150ee3e9accd01310
bd7680f0d4768bf17b38b5834d7671e6e456d9655b4ae3cb39186d1fcd93f5c2
c0c2ec1f2d626ab278d81abe34d30681f0007e8c79a890165f27e3e1550e99b7
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
c78e2064607d62e3d40dcc77d241c5ca3a5dd30f4756f78e76a16ec1fd5f939e
c7e76d44c88e8c172f66eb413a359494fdc7569ebac417ac2de0c2a232152dd8
c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15
d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e1d764f3e532938e603f338c298fbe772f04b9e709b38384584f5efd4f96387d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eea35b9ad480903527d6e81449d165f1d719f5cb6de0fce541b32914f4e59b9f
f39c440545917b3958467aba2277b8798295c85580f3581a4f1e7fa9d79ef597
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fa6566c193a0f52c4341498a1c39613f0c040df3100d1ddb68ff95b45f7d0616

el7lwa.com Open in urlscan Pro 2606:4700:3031::6815:4dda Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

223 Requests

88 %HTTPS

47 %IPv6

41 Domains

56 Subdomains

51 IPs

4 Countries

2066 kBTransfer

5758 kBSize

25 Cookies

6 Outgoing links

Page URL History

Redirected requests

223 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

el7lwa.com Open in urlscan Pro
2606:4700:3031::6815:4dda Public Scan

Screenshot
Live screenshot

Full Image

223
Requests

88 %
HTTPS

47 %
IPv6

41
Domains

56
Subdomains

51
IPs

4
Countries

2066 kB
Transfer

5758 kB
Size

25
Cookies

223 HTTP transactions
7 data transactions