www.bg3.co Open in urlscan Pro
84.17.37.44 Public Scan

Software

sffe /

Resource Hash

5b43780c96623b3a913b0cbfe1284b1c393563fca74ce8676a412b77906d2d2b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 13 Oct 2022 17:20:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72501
x-xss-protection: 0
server: sffe
etag: "b0a9bc3cc165f0cd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Oct 2022 17:20:44 GMT

GET
H2 200 amp-sidebar-0.1.js Show response
cdn.ampproject.org/v0/ 31 KB
11 KB 519ms
174ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-sidebar-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ece948d98c5e739c54ec068ea618b60e9649127a30091b85ad155b63ce934e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 13 Oct 2022 17:20:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9664
x-xss-protection: 0
server: sffe
etag: "b2cba6000b3c8a65"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Oct 2022 17:20:44 GMT

GET
H2 200 amp-auto-ads-0.1.js Show response
cdn.ampproject.org/v0/ 24 KB
7 KB 873ms
547ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f0d0bceea71a5f83c45cf3c926b7e9e5b51f9a8c3ac83b3d158c33eaf3a9a51

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 13 Oct 2022 17:20:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7571
x-xss-protection: 0
server: sffe
etag: "87d590c66fd5781f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Oct 2022 17:20:44 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ 109 KB
31 KB 527ms
201ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01a989def5188d77aee84e4ce053666e0c5d2207bb7570c9d4991632afac09c9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Thu, 13 Oct 2022 17:20:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31967
x-xss-protection: 0
server: sffe
etag: "dfda97fe2a1b5ffc"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Oct 2022 17:20:44 GMT

GET
H2

200

sdk Show response
cdn.aralego.net/ucfad/sdk/apac-hk/
Redirect Chain

https://ads.aralego.com/sdk
https://cdn.aralego.net/ucfad/sdk/apac-hk/sdk

43 KB
43 KB

275ms
95ms

Script
application/octet-stream

172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/sdk/apac-hk/sdk
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 28bf646c6e799ca96adb3a5b48fe882639d31e27102cad9ed2979555da55944a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5176
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43705
last-modified: Thu, 22 Sep 2022 10:09:00 GMT
server: cloudflare
etag: "632c343c-aab9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l59u955EOZhbjcV4sFPOCjAHMAjNTHnazdCj98nwtI6tl2MZciBjVptPLNi2oJOktUsP9WoaOxbduE6zIJH%2FTI1gkP7L%2FPP45nn84sTKN9%2F8L9UGjbwbfT%2FsD5uIfH%2F6jA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 7599bf67dc865ab8-MEL

Redirect headers

Location: https://cdn.aralego.net/ucfad/sdk/apac-hk/sdk
Connection: close
Content-length: 0

GET
H2 200 adRecover.js Show response
delivery.adrecover.com/43519/ 33 KB
9 KB 2229ms
1246ms Script
application/javascript 184.87.193.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://delivery.adrecover.com/43519/adRecover.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.87.193.92 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-87-193-92.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 /
Resource Hash: 6ca74b5ea2bc647b556b4bed62192d55a370ac314556e21f568c0a194a3bea5d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: AU
date: Thu, 13 Oct 2022 17:20:45 GMT
content-encoding: br
last-modified: Thu, 13 Oct 2022 07:00:30 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=MISS, edge; dur=7, origin; dur=906
x-cf-geodata: AU
content-length: 8787
expires: Thu, 13 Oct 2022 18:20:45 GMT

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/42753/ 479 KB
103 KB 1458ms
868ms Script
application/javascript 23.52.171.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/adpushup.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.171.82 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-52-171-82.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 /
Resource Hash: 293fc15c33edf25fff2ef66e3b4d300e21de6a3ed7e6ed2441827fb34a3cf4d4

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: AU
date: Thu, 13 Oct 2022 17:20:45 GMT
content-encoding: br
last-modified: Wed, 05 Oct 2022 09:36:33 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=MISS, edge; dur=238, origin; dur=456
x-cf-geodata: AU
expires: Thu, 13 Oct 2022 18:20:45 GMT

GET
H2 200 fc925aa49f1925bcdbac09f1b608a822.jpg
static.bg3.co/imgs/202105/ 7 KB
7 KB 767ms
576ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/fc925aa49f1925bcdbac09f1b608a822.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db126765a241625d25b07810da4b1538400ab0026810771def2b61f67904965c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Wed, 26 May 2021 06:18:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "FC925AA49F1925BCDBAC09F1B608A822"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rr1M0RpHVwwF6RhRwtu2coypz0mRqz46qR8vryJKANaVSN0OXIqE3xcrR%2BFSFtJs7S1usK8Nm4lop81oxy%2BH90ozLo2u3IrPpjLZRoLC4iQtid0HonL4UGB%2FfaLNjws%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6909575ac8-MEL
content-length: 6847
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 977f05b94c2f12422f3d258e38541777.jpg
static.bg3.co/imgs/202105/ 6 KB
6 KB 845ms
655ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/977f05b94c2f12422f3d258e38541777.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9207ade502fc3086dbcfb755e4cbe913e10201edbedeae4ec003fed1b3a63bf7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Sat, 29 May 2021 01:53:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "977F05B94C2F12422F3D258E38541777"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NTVyEV6Zumpero%2FPJsWb5R7IomR3qdoTa2iPSryoyEr%2BmYA7kV71Ohm50LFophLdtq%2FZkY%2FxEJGPSjrGu3karIi%2BK7%2F95kWnQlwHlvyGAGLShfDpPEODFaat18qVdeA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6909595ac8-MEL
content-length: 5867
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 61a405a10c768129ac8a3cf7cea9c7b2.jpg
static.bg3.co/imgs/202105/ 10 KB
10 KB 845ms
655ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/61a405a10c768129ac8a3cf7cea9c7b2.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac45d9a4953643c89e84e0f11f1966de0ddf51e35871e78fa3ec9103907fc826

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Tue, 01 Jun 2021 02:18:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "61A405A10C768129AC8A3CF7CEA9C7B2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2BFuRVee0jj11LshucoYGVaK7cMFcW1RfDkO6ViCgVLpd9hS%2FvfE7kbwrVhDu40xZFNcuQRnl%2Bxca%2B%2F4j2SjlmmE11HV6WvLyhe9Qn0eHUFzNKS7NSe1i69PEYI4MN8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6909585ac8-MEL
content-length: 9950
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 9caf134f02914c5ed2f2ea8b16a1977c.jpg
static.bg3.co/imgs/202105/ 8 KB
8 KB 781ms
591ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/9caf134f02914c5ed2f2ea8b16a1977c.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89b19b2c855bd30e60b84b88a7452e53ae1f145d0c343d66720cd8aa819096fd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Sat, 29 May 2021 03:59:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "9CAF134F02914C5ED2F2EA8B16A1977C"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b%2FO8Cjz5JtAKCC6hFwBtBgM0F1c5MDHX8KZ%2FHSSvQ2KlLxpWH3Y%2FNsTRAG3UvAtNSm8IIdeQQ06XFuLv5Hq3jn8LimUi0b6E%2FITMfXk1VSyrjztNrrXSEuyxdSjoNMM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf69094d5ac8-MEL
content-length: 7964
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 a12c2f68a305b4675527c5f91170cff1.jpg
static.bg3.co/imgs/202106/ 4 KB
4 KB 770ms
581ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/a12c2f68a305b4675527c5f91170cff1.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96d3ce6af58f54bcfba04e4e9a9171df3ad492e71009259f8b28d1e9ed196e80

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Tue, 15 Jun 2021 17:35:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "A12C2F68A305B4675527C5F91170CFF1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iAcA5jU2ewUEBZ%2BH3mVTQHuHrW6a3z5VWq4%2FTj93s%2BNR8Z0k4BT%2BHXr%2BkgG4kTgxPsON8lBsH0AFC%2BLUM91JD9KShXWKTWpIbqd4Ew9e7Uh80gBvfybugOcI9COhgiM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf69094f5ac8-MEL
content-length: 4133
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 0868f1afa3c949380ea58776514381e9.jpg
static.bg3.co/imgs/202105/ 16 KB
16 KB 937ms
747ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/0868f1afa3c949380ea58776514381e9.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1408cab9d1096116d870d2ada987a4c8effff6dbd9c92513368b1679761402f5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Wed, 26 May 2021 06:30:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "0868F1AFA3C949380EA58776514381E9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2fyVhlPJiHVu%2F6QP1yrZ7ZRvM2yEaxdCDXJoaLPjrS1fZO71vsvuuYyBGOmQVeHt8pPQlZwXh5kWJ4bb%2Be%2BwRAPWD7PZYqaI0Itg%2BOY9BlbTm8I1F%2BKQtDLyhV13Qes%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6909525ac8-MEL
content-length: 16290
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 76cdf3ee1ec81d2ce88821051f75e516.jpg
static.bg3.co/imgs/202105/ 9 KB
10 KB 845ms
659ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/76cdf3ee1ec81d2ce88821051f75e516.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32b49a1e547e03a74128df7c9d85343c8a407296c251c53d5befe1f0947af098

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Mon, 31 May 2021 23:36:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "76CDF3EE1EC81D2CE88821051F75E516"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aLyV8bXVdrGxK0G523wLgwdS1oyzRFh7zbA3I2KpzzNQhWoX%2F3vyisH3NHEI247N2bDvwWvfdOMVqTTUwUdB8E3BHxrUxXkzmpjGAGoExFyNe4VKOgOHIyZvKMQXkX0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6909535ac8-MEL
content-length: 9629
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 59cc1a3492b77938d9cded44e309cfa4.jpg
static.bg3.co/imgs/202105/ 4 KB
4 KB 772ms
586ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/59cc1a3492b77938d9cded44e309cfa4.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26ed37548ab1a35355762dae4fc699bad380d6ca66899a1e37985582e1700370

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Mon, 31 May 2021 12:36:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "59CC1A3492B77938D9CDED44E309CFA4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6QHJBYKl2c4DG3bKvey%2FChQSEnIpFjrSr%2FrZn3x9N8TSUfwpz3KFS7WCdz%2BAIYZDQEvfTWEx7CpFMq%2BxB5RnUscn0CVChEMX1J%2FXooxRzAKT5RG64jtc%2BRlgJapZphM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6909565ac8-MEL
content-length: 4101
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 6d2aacdb11e5c5e5fd8891edcb344881.jpg
static.bg3.co/imgs/202105/ 3 KB
3 KB 658ms
657ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/6d2aacdb11e5c5e5fd8891edcb344881.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65a241ee8dc07b39aacc93717b6a3c2b4d639f123678d33b44fb12d0294245aa

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Mon, 31 May 2021 13:31:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6D2AACDB11E5C5E5FD8891EDCB344881"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gWu6gGEMVfjoTx7%2BOJ2F%2Bkywglev%2BZ9bvY6EwQFDb0O1WUO4Zy99xEBUVig8kwYSMnYrQv%2FNFkcvdalWvBuGxpJlWJftwJfZS4rV%2BqQyJiD5d839L6yR3h41wM5npIM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989a95ac8-MEL
content-length: 2572
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 8170fe843fd3191254f8f2f679705fc8.jpg
static.bg3.co/imgs/202105/ 5 KB
6 KB 664ms
663ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/8170fe843fd3191254f8f2f679705fc8.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 453c11fb3154b7b520d0bca91a52d11150d9361a84b6da28ef96c5503afc2514

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Wed, 26 May 2021 01:00:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "8170FE843FD3191254F8F2F679705FC8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TwKvlKdxgFtTtukz%2BsTohUfc0zvv3IirN9A8DW%2BjCH%2FuVjbms6OVmB3DxNAoJlL5l1TRkfKCDJs9emdoyTxWYWoXs%2B4faOBlsy%2F%2F7Cu9PKOvFikQwUwqCKooiOf6bIY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989ad5ac8-MEL
content-length: 5406
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 3290a6816ef9b13f88c94d16eec1a590.jpg
static.bg3.co/imgs/202105/ 7 KB
7 KB 743ms
742ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/3290a6816ef9b13f88c94d16eec1a590.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92f263fb89a3234b0c66cc5818c5b522b36e87e2c21d98976a3e3ed888ef98aa

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Fri, 28 May 2021 15:41:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "3290A6816EF9B13F88C94D16EEC1A590"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jiInInepwaY7joobm92zpdSr5WBupYbOimzPvUdvTbsnWKPfYJtAS8ZmbJPzNDMnGAnYdB0xNhtWqinxefOTXY4X%2FyTpuIUGNJ1NP4Cx46PkTmqAYJ9XPowx6Ns1YzQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989af5ac8-MEL
content-length: 7301
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 b6a8b40eb491d1c1a2b91894c521ed26.jpg
static.bg3.co/imgs/202106/ 5 KB
6 KB 740ms
738ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/b6a8b40eb491d1c1a2b91894c521ed26.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad73c232109c057a434b19c7fb5e1b82724b1325fdc22a12e5580be1572abbc4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Fri, 04 Jun 2021 04:12:11 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "B6A8B40EB491D1C1A2B91894C521ED26"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GBcSFbM6dCc%2Bpz7kfFMBHhmFUQRwWfM6NVJRTCXn1Vw7pshl1rRwrrt9Pz22N7kVif6yAszElGDbL0yoEhgrNfKOHJ8LwI5rlN4P9BMgkZwYVHAlx0q4jl4%2FlYRTPJw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b15ac8-MEL
content-length: 5595
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 f6ed7836e1fe05840108099b0bc09678.jpg
static.bg3.co/imgs/202110/ 7 KB
7 KB 670ms
669ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202110/f6ed7836e1fe05840108099b0bc09678.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e362730ac194d0d92283c0fece7fdd584bf2ed11c3a5795a0fa682e21ab114a0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Thu, 21 Oct 2021 06:16:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "F6ED7836E1FE05840108099B0BC09678"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mBY5kA%2FoZSXlNi5YAz17ct2gQkJSal6e0p1IR%2Fu3pcNCVEQfKqoiMoaLvsBZPWO8lZ8czDrOge1%2FHoSH7hyl%2BJyp7QhSlM8my%2B3MD0EFPS5oUlc5hyOZE%2FR8C3PC6d4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b25ac8-MEL
content-length: 7146
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 aa45c9c5f65e1243b096eaac494e5c84.jpg
static.bg3.co/imgs/202105/ 9 KB
9 KB 898ms
897ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/aa45c9c5f65e1243b096eaac494e5c84.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0634c40628f864beb82075c686d384ec2dc4e65c0b87ea1858741f34e6c617f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Mon, 31 May 2021 21:47:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "AA45C9C5F65E1243B096EAAC494E5C84"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Z%2F5E1MUPFpWjzHp4f6WeBjoFzphrnyw8SLnknKbQr9EE%2Bv9LJCQAGDxFpf9nIum%2BoIf8QfWElbee69QJz5%2FpuSHmPSRL4jS1rYGrtdr0iPOMPloZQ7f%2BFrRL5pL5dY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b35ac8-MEL
content-length: 9097
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 98b05d40778ce8dd998b1662d6ec4807.jpg
static.bg3.co/imgs/202107/ 5 KB
6 KB 755ms
754ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202107/98b05d40778ce8dd998b1662d6ec4807.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2773c7902088953cdbb8bd59b8b8124d3a45552ed1395df25fe52989797ec53

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Thu, 22 Jul 2021 13:14:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "98B05D40778CE8DD998B1662D6EC4807"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ARITuXRPWR6%2FEHd37L1uF5g7dudBBDzfATSj8hgq7IIJEJaCtzvHRAA456efuFxzDQMVefHlaoFA%2BseThv1wth%2BtpOtHCCgowoy6s4Tvbdh3xLBkZ9LOGZn4ppXVbgQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b45ac8-MEL
content-length: 5532
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 4c1cdf38b3c193a0e63a60ec5017552a.jpg
static.bg3.co/imgs/202105/ 7 KB
8 KB 742ms
741ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/4c1cdf38b3c193a0e63a60ec5017552a.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 724a997461dc3d3cb27e6d1c9b4dfc7b338275360a56e5e78df83ac54f20bb0a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Sat, 22 May 2021 14:15:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "4C1CDF38B3C193A0E63A60EC5017552A"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QiPqdkPyfNA4lxxApgJQoJBiPBa9dPzGTqWus6nqe%2Bl0UB%2BdI85YRXB95Igqb%2BdUdkydMWkCy2FsRpRku%2FUcYsMUQJRQXwivjSgT%2FsrKOBZy%2FfoySKqJvq1WJG8TTZ4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b55ac8-MEL
content-length: 7601
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 960efd4d7465a703c3d41382b270a38a.jpg
static.bg3.co/imgs/202105/ 7 KB
7 KB 675ms
674ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/960efd4d7465a703c3d41382b270a38a.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99714b11db9c8b914c234aa257e19688c0d5cf5981c45508650c3c253026a878

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Mon, 24 May 2021 23:51:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "960EFD4D7465A703C3D41382B270A38A"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bYvf3p5DRwWN9cwgPnQkTBYBMfR28q%2FhpCwauD0GVk2gxa3JpcqrBfEgWilwyYQ4j2hTQCy7hH4i7ZZU8R3iHQdfmCXJmWLy0DWXkl%2Bsp%2FVJL45lC%2BcZRUq%2B8wm6oG4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b65ac8-MEL
content-length: 7116
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 68f3eecede4280c62eb8765414314f6c.jpg
static.bg3.co/imgs/202106/ 6 KB
6 KB 880ms
879ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/68f3eecede4280c62eb8765414314f6c.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 804c3790da1afb61d0385e68f31ce96f69fe704c3406d184e47a6e77d2014d56

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Sat, 05 Jun 2021 12:01:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "68F3EECEDE4280C62EB8765414314F6C"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7H9gN9g80QJ8Mfy%2BYlTNHnCEF2%2Fjswjnw4x%2FG5kTPCTJtThQTJEfUK9vF38Rk485wvMeVgceIbw5bG32sOIJe55T%2FdEHpwwc7lRagE9ZB8VKZY6zz8QBIsNqDP2NJnM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b75ac8-MEL
content-length: 5743
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 1668d388e088f791bf369ca33debf98f.jpg
static.bg3.co/imgs/202105/ 10 KB
10 KB 660ms
659ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/1668d388e088f791bf369ca33debf98f.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 116cb22a5e66694c630d193e49183fbb3da6115598c7afd18c558aec1ecc4f7b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Mon, 31 May 2021 05:24:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "1668D388E088F791BF369CA33DEBF98F"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4vQ9ikHBx5yoPUGwK%2FL9a3QUZxPccMAtMtlgLAqqbJYGChTRrRMM5JcUHlW%2FVXRwY48N7plE1xtozXyp4FpQ%2BMcaLBj2szI%2Bn2gcjOITO9U7su05%2Fu1qj4h9d9Nc8kY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b85ac8-MEL
content-length: 9986
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 2308cb8828473d03bb2ef95037973c58.jpg
static.bg3.co/imgs/202106/ 6 KB
6 KB 757ms
756ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/2308cb8828473d03bb2ef95037973c58.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01881c03fd717038fe759bd7afcf7a51add6abd3d66b3c94895a8f46eee8cddc

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Wed, 09 Jun 2021 09:45:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "2308CB8828473D03BB2EF95037973C58"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RjYmtaThleL7v4Q5MeLyc9fiAeSBxv21NuhIM8bSEXc%2BnCykDhDbj0cpQlfSfI8EANClsS0Lnc%2BIEGpi%2BPM%2F0w%2FgHqXG79E1aBcVWS%2FETj2rq4y97poE2lMe0nrfr7g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989b95ac8-MEL
content-length: 5943
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 b894c0a562b9939d34f6c29e2c086eb1.jpg
static.bg3.co/imgs/202106/ 5 KB
5 KB 738ms
737ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/b894c0a562b9939d34f6c29e2c086eb1.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cff7e865e71acf6352c01d21d69cc5e482ad7d5fbb592dde22bf4136838ccdbe

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Mon, 14 Jun 2021 21:36:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "B894C0A562B9939D34F6C29E2C086EB1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Po8VAcaAP5MIWqOFwC9BAqVVWBYASK2GEcAO4vjusDJb0ZIuEG3%2B8Pc2nyRLvMqc%2BuDodBiKJHUP3ymaa%2BWjA%2FHA5vmjTULVAGZ%2BxjlKlnwMBHWkJUfz5rPNsiKbyn0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989ba5ac8-MEL
content-length: 4860
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 c31bf7b0b4231b2a01423940652b3bf5.jpg
static.bg3.co/imgs/202106/ 9 KB
10 KB 749ms
748ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/c31bf7b0b4231b2a01423940652b3bf5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 422898511bc31b26dd2952e4d90cdeceba152f96e7a1c590003c300cd3a6f1dd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Thu, 03 Jun 2021 12:33:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "C31BF7B0B4231B2A01423940652B3BF5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yTbUFJfspvL77TghYtyxi6cQMS0HNFBJoyqxivbrm5u9jm6bALjel%2BB9WJ6tcqSanGpGQYEDsmdia8J4QeRWe5XV2XCWkcBbBbmJotOpufuHH5jPDc7%2F2wVKGIsFD%2Bw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989bb5ac8-MEL
content-length: 9672
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H2 200 73a3b4e5b997d4b82a645a79afc94adf.jpg
static.bg3.co/imgs/202105/ 5 KB
5 KB 756ms
755ms Image
image/jpeg 172.67.72.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/73a3b4e5b997d4b82a645a79afc94adf.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c85e2a39a10d62f76d857018aac04426d2d6a9bed730b198fa07b2a432526696

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
cf-cache-status: MISS
last-modified: Tue, 25 May 2021 12:30:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "73A3B4E5B997D4B82A645A79AFC94ADF"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x6%2BZoMJQ95%2F9EIl7C00rM0VITYtTTmgLKnSaCq8Lws%2FM7%2Bqu7xQph0oGJDcfhTEAG%2B%2Fu7ILAt1SlK61ilImN1%2FfNezuFfcWn%2FrxXNRPtgY9uv5GrQjgxOYg7GXwgk3k%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7599bf6989bc5ac8-MEL
content-length: 4768
expires: Thu, 20 Oct 2022 17:20:45 GMT

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012209142312000/v0/ 8 KB
3 KB 570ms
232ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209142312000/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2846f489aec534c06de31b1be7cc5f7f9b231cc6b468859383229bf0b41cb28

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 08 Oct 2022 06:56:43 GMT
age: 469442
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2980
x-xss-protection: 0
server: sffe
etag: "ac16e77745c88a40"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 08 Oct 2023 06:56:43 GMT

GET
H3 200 amp-ad-0.1.js Show response
cdn.ampproject.org/rtv/012209142312000/v0/ 81 KB
23 KB 499ms
168ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209142312000/v0/amp-ad-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e64a4894f14fab865296b82dd97d4d3ea3bcec78b5378d9b9ef57f5515948d8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 09 Oct 2022 01:13:09 GMT
age: 403656
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23032
x-xss-protection: 0
server: sffe
etag: "17406dee48d4bcdb"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 09 Oct 2023 01:13:09 GMT

GET
H2 200 ama Show response
pagead2.googlesyndication.com/getconfig/ 2 KB
962 B 515ms
171ms Fetch
application/json 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/ama?client=ca-pub-3216231935713038&plah=www.bg3.co&ama_t=amp&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14b59c882022f921f565be91809db66d513217f7fa197eafad68075f224458d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 513
x-xss-protection: 0

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012209142312000/v0/ 12 KB
4 KB 569ms
241ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209142312000/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a2369a751f3053ccb3ded318d323026bdff42c1e269153dc54a585ddd8d7c36

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 08 Oct 2022 17:54:18 GMT
age: 429987
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3844
x-xss-protection: 0
server: sffe
etag: "02cbbdb857ad171c"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 08 Oct 2023 17:54:18 GMT

GET
H2 200 ucfad-formats.css
cdn.aralego.net/css/dev/ 975 B
613 B 93ms
92ms Stylesheet
text/css 172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/css/dev/ucfad-formats.css
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1be00e223b2840fe8ac2d3a1aec0cf757088dd68f53a92275d0e1db6cb9afced

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:44 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5366
cf-polished: origSize=1191
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 16 Mar 2018 07:19:46 GMT
server: cloudflare
etag: W/"5aab7012-4a7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C77OygcGAkDdTNeHZeFD46ImQ9dObFnZ45jYuI1F4PuYlJVb6kJAdK3%2FkH46HSnE43RJ1W5b53qzhJ6pagsevu5bso5Mgn08ntZdpG9zxWiFNQRayvoIWNcyzP2t2%2BtiOA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 7599bf687ce25ab8-MEL

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 809ms
202ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: d8e9dd83c02f3d3e28ebdd14038521d3f9d598ad18e660706a14f12d42dacd19

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:45 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 825ms
207ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: d8e9dd83c02f3d3e28ebdd14038521d3f9d598ad18e660706a14f12d42dacd19

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:45 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 763ms
352ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=0&cb=0.7315147920178207&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:45 GMT
X-Width: 336
X-Height: 280
X-AdStyle: banner
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Expose-Headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
X-AdSource: PSA
X-Adtype: html
Connection: close
Content-Length: 508

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 765ms
355ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=1&cb=0.5712784977372309&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:45 GMT
X-Width: 336
X-Height: 280
X-AdStyle: banner
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Expose-Headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
X-AdSource: PSA
X-Adtype: html
Connection: close
Content-Length: 508

GET
H3 200 amp-sticky-ad-1.0.js Show response
cdn.ampproject.org/rtv/012209142312000/v0/ 39 KB
10 KB 169ms
168ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209142312000/v0/amp-sticky-ad-1.0.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a96ad4768f32ec875b5e6d4ff9e5107eb19401974d337d1ff79e8da9f435f446

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 13 Oct 2022 07:10:47 GMT
age: 36598
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10253
x-xss-protection: 0
server: sffe
etag: "76108468fe259c2d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 13 Oct 2023 07:10:47 GMT

GET
H3 200 amp-ad-network-adsense-impl-0.1.js Show response
cdn.ampproject.org/rtv/012209142312000/v0/ 214 KB
57 KB 169ms
169ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209142312000/v0/amp-ad-network-adsense-impl-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4b064035d7575f4bec0fd5729fa76ed3aa06324415dffb767812d0b815e0b34

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 11 Oct 2022 16:13:01 GMT
age: 176864
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57872
x-xss-protection: 0
server: sffe
etag: "9dc55ff1bd63fdb7"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 11 Oct 2023 16:13:01 GMT

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 921ms
316ms Script
application/javascript 69.16.175.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1665681646.dop110.la3.t,1665681646.cds218.la3.hn,1665681646.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 38ED 119 KB
39 KB 609ms
268ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1cd972a4a83649dfd60aa5b8004e120565c5b899cfca04d9444c13ebb8e91ec0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39804
x-xss-protection: 0
server: cafe
etag: 2245875743132596436
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 13 Oct 2022 17:20:46 GMT

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame CDF2 113 KB
37 KB 526ms
186ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90f7da2705022ffc6a1ded1e857a2773b34cd762b5871a3530c8ba798fc73126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37955
x-xss-protection: 0
server: cafe
etag: 11574509426715807296
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 13 Oct 2022 17:20:46 GMT

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame 17BE 714 B
803 B 101ms
101ms Document
text/html 172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 5406
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 7599bf6d8f7c3775-MEL
content-encoding: br
content-type: text/html
date: Thu, 13 Oct 2022 17:20:45 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zz3LGRMXjd%2FaU32JgQyn34ORDf36Qq49I%2Bmi0lDGg%2FfI%2Br%2B0Nk9zeNLB5TyI2myr%2B6TpMFVDWknISg0l5qM44kUDstt7jDB2bFoT1%2F1FgsWkKODIq6WWKnq4QhFhxLObAA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK idsync
sync.aralego.com/ 35 B
384 B 620ms
208ms Image
image/gif 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.aralego.com/idsync?gdpr=1&euconsent-v2=${GDPR_CONSENT_607}&
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:46 GMT
Connection: close
Content-Length: 35
Content-Type: image/gif

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame E2DC 714 B
764 B 92ms
92ms Document
text/html 172.67.71.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.71.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 5406
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 7599bf6dbf933775-MEL
content-encoding: br
content-type: text/html
date: Thu, 13 Oct 2022 17:20:45 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V1NKM3wa5j3yfi8p0oIlG%2Fr1T3d0BUAts6yWGzEAFB1hLrhnSJgRf98%2BzjgC4uW72ULDoCnUvoklRFozY%2FbsKANU%2BiDsg9zBqJUFEl1VT%2FEckifrl5EiVU3oY2v%2Fx0Nmmg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 integrator.json Show response
adservice.google.com/adsid/ 86 B
572 B 523ms
175ms Fetch
application/json 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.json?domain=www.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14cfb5058acaf3af2f07088f1582f29941d7a4cc74fd1cea5050cecad862d154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0

GET
H2 200 nameframe.html
d-883356765132962755.ampproject.net/2209142312000/ 0
0 519ms
172ms Other
text/html 74.125.130.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d-883356765132962755.ampproject.net/2209142312000/nameframe.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.130.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f94.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 gtag.json Show response
cdn.ampproject.org/rtv/012209142312000/v0/analytics-vendors/ 2 KB
931 B 170ms
169ms Fetch
application/json 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209142312000/v0/analytics-vendors/gtag.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8993772c9eb591474f38d257bebc8c4286703e1af72d04c8c294be5fff7b649

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 08 Oct 2022 23:23:17 GMT
age: 410248
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 901
x-xss-protection: 0
server: sffe
etag: "4d194710e2f2f90c"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 08 Oct 2023 23:23:17 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 17BE 79 KB
28 KB 529ms
175ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c679a1034ac6c28715f9d3a3d566c1e6d6a2cd7477af8f4a922ae4a9e91eab85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27720
x-xss-protection: 0
server: sffe
etag: "1362 / 265 of 1000 / last-modified: 1665675633"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 13 Oct 2022 17:20:46 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame E2DC 79 KB
27 KB 691ms
358ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c679a1034ac6c28715f9d3a3d566c1e6d6a2cd7477af8f4a922ae4a9e91eab85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27720
x-xss-protection: 0
server: sffe
etag: "1362 / 398 of 1000 / last-modified: 1665675633"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 13 Oct 2022 17:20:46 GMT

POST
H2 200 amp Show response
www.googletagmanager.com/gtag/ 610 B
808 B 520ms
172ms Fetch
application/json 74.125.24.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/amp?__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

8492f3fc13f89700f09e8a96308911979a6289be084af2c497ea54dbd7dd7f5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=utf-8

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="amp.json"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
pragma: no-cache
amp-access-control-allow-source-origin: https://www.bg3.co
server: Google Tag Manager
vary: *
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jquery-2.2.2.min.js Show response
code.jquery.com/ 84 KB
29 KB 703ms
646ms Script
application/javascript 69.16.175.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.2.min.js
Requested by: Host: delivery.adrecover.com
URL: https://delivery.adrecover.com/43519/adRecover.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-14e98"
vary: Accept-Encoding
x-hw: 1665681646.dop110.la3.t,1665681646.cds218.la3.hn,1665681646.cds210.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29880

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/ Frame CDF2 352 KB
124 KB 190ms
190ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

941a6b60315b40737a101c1b13ace30c6ebfc42669d5bf9263dc0271daee92ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127108
x-xss-protection: 0
server: cafe
etag: 1718629012179166434
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Oct 2022 17:20:46 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/ Frame 38ED 353 KB
125 KB 287ms
286ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/show_ads_impl_fy2021.js?bust=31070320

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

117a1b545b8b6be60b18335c0e80adb450dd5954079edb539775b242fa4503dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127506
x-xss-protection: 0
server: cafe
etag: 17197120483303530764
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Oct 2022 17:20:46 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
396 B 513ms
170ms Image
image/gif 172.217.194.139
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=%E5%AF%8C%E8%B1%AA%E7%A7%BB%E6%B0%91%E8%AE%93%E5%A4%A7%E9%99%B8%E7%B6%93%E6%BF%9F%E5%B4%A9%E6%BD%B0%EF%BC%9F%E3%80%808%E6%88%90%E7%B6%B2%E5%8F%8B%E4%B8%BB%E5%BC%B5%E8%A8%AD%E9%99%90%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&sr=1600x1200&cid=amp-UBC05d4z3uBSF4l475Zznw&tid=UA-172083736-2&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&dr=&sd=24&ul=en-us&de=UTF-8&t=pageview&jid=0.17238999257645382&gjid=0.8642374189706505&_r=1&a=9989&z=0.6548496888629807&gtm=2pu000

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2022100602.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 17BE 380 KB
128 KB 474ms
172ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea6e8403bf62c55c1954717c65e41068390e120cab9878cb6851b64cf4b011d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 17:33:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85659
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131300
x-xss-protection: 0
last-modified: Wed, 12 Oct 2022 15:58:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 12 Oct 2023 17:33:07 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6DE7 603 B
379 B 697ms
694ms Document
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=1600x250&w=1600&h=250&ptt=12&adk=2733026255&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-37693362601435337333&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=470780615&nhd=0&adx=0&ady=3279&oid=2&is_amp=5&amp_v=2209142312000&d_imp=1&c=434475009989&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&ga_hid=9989&dt=1665681645827&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&bdt=2113&dtd=403&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012209142312000/v0/amp-ad-0.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:46 GMT
expires: Thu, 13 Oct 2022 17:20:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_2022100602.js Show response
securepubads.g.doubleclick.net/gpt/ Frame E2DC 380 KB
128 KB 429ms
173ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea6e8403bf62c55c1954717c65e41068390e120cab9878cb6851b64cf4b011d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 17:33:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85659
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131300
x-xss-protection: 0
last-modified: Wed, 12 Oct 2022 15:58:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 12 Oct 2023 17:33:07 GMT

GET
H2 200 pb.42753.1663912421366.js Show response
cdn.adpushup.com/prebid/ 342 KB
92 KB 1391ms
885ms Script
application/javascript 23.52.171.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.171.82 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-52-171-82.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 /
Resource Hash: 1c479d0abecadc8d5fde30eeb515508b6148fa3d92dd617b427788d6c792b0a8

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: AU
date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: br
last-modified: Fri, 23 Sep 2022 05:54:31 GMT
server: nginx/1.18.0
etag: W/"632d4a17-5578b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=MISS, edge; dur=242, origin; dur=467
content-length: 94168
expires: Fri, 13 Oct 2023 17:20:48 GMT

GET
H2 200 quantcast.js Show response
cdn.adpushup.com/pbuseridscripts/ 450 B
505 B 662ms
184ms Script
application/javascript 23.52.171.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.171.82 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-52-171-82.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 /
Resource Hash: 26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: AU
date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: br
last-modified: Mon, 28 Jun 2021 04:15:23 GMT
server: nginx/1.18.0
etag: W/"60d94cdb-1c2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=10
content-length: 211
expires: Fri, 13 Oct 2023 17:20:47 GMT

GET
H2 200 linkPreview.js Show response
cdn.adpushup.com/42753/ 72 KB
17 KB 670ms
193ms Script
application/javascript 23.52.171.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/linkPreview.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.171.82 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-52-171-82.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 /
Resource Hash: 968012b3a49390a10d31c6d36b2aab796ec167a83378b5f9787756ee7cb035c5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: AU
date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: br
last-modified: Thu, 14 Jul 2022 19:44:27 GMT
server: nginx/1.18.0
etag: W/"62d0721b-11ed1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=13
content-length: 17440
expires: Thu, 13 Oct 2022 18:20:47 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 79 KB
27 KB 286ms
242ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3be1fe1d134cd532a649cb7b01cf840d7d8244fc10269b3b3eb6890db0f46bc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27722
x-xss-protection: 0
server: sffe
etag: "1362 / 618 of 1000 / last-modified: 1665675679"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 13 Oct 2022 17:20:46 GMT

GET
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
539 B 520ms
170ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:47 GMT
server: nginx/1.10.3 (Ubuntu)
ap-cookie-status: cookies ap_uid and ap_usid are set
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CDF2 0
20 B 171ms
171ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=abg_host&host=www.bg3.co&eid=44759875%2C44759926%2C44759837%2C42531706

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CDF2 0
20 B 170ms
170ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=afc_etu&etus=4&sig=2&tms=200&eid=44759875%2C44759926%2C44759837%2C42531706

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame CDF2 379 B
693 B 516ms
174ms Script
text/javascript 74.125.130.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sb-in-f154.1e100.net

Software

cafe /

Resource Hash

ee9ab61b0c6c6d38d7520ec8e6bd0d68a94761b3ce4058f0e2bd41f025c53951

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ Frame CDF2 107 B
792 B 527ms
176ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame CDF2 107 B
196 B 480ms
179ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2C3A 23 KB
10 KB 489ms
488ms Document
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646357&bpp=13&bdt=1509&idt=489&shv=r20221011&mjsv=m202210040101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=2&ga_vid=2132115411.1665681647&ga_sid=1665681647&ga_hid=1324712338&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1106&biw=1600&bih=1200&isw=336&ish=280&ifk=876476303&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706&oid=2&pvsid=1075327899981005&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221012&fu=4&bc=31&ifi=1&uci=1.io3081os5z2z&fsb=1&dtd=507

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cfb444a73ce7759b197c14511b86cf6bde315cdefe16f19fb39a582518827b31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9950
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:47 GMT
expires: Thu, 13 Oct 2022 17:20:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 436ms
183ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjU2ODE2NDY4NzUsInBhY2tldElkIjoiMDAwMEE3MDEtNWQ5ZjI1NzAtMDM0MS00NmFmLTlhMDgtNjg4M2Y3ZWRlZjgyIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2Z1LWhhby15aS1taW4tcmFuZy1kYS1sdS1qaW5nLWppLWJlbmcta3VpLThjaGVuZy13YW5nLXlvdS16aHUtemhhbmctc2hlLXhpYW4uaHRtbCIsIm1vZGUiOjQsImVycm9yQ29kZSI6MCwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpudWxsfQ%3D%3D&c_b=4445.399999856949
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:47 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 430ms
178ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjU2ODE2NDY4NzYsInBhY2tldElkIjoiMDAwMEE3MDEtNWQ5ZjI1NzAtMDM0MS00NmFmLTlhMDgtNjg4M2Y3ZWRlZjgyIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2Z1LWhhby15aS1taW4tcmFuZy1kYS1sdS1qaW5nLWppLWJlbmcta3VpLThjaGVuZy13YW5nLXlvdS16aHUtemhhbmctc2hlLXhpYW4uaHRtbCIsIm1vZGUiOjUsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpudWxsfQ%3D%3D&c_b=4446.199999809265
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:47 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 431ms
178ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjU2ODE2NDY4NzYsInBhY2tldElkIjoiMDAwMEE3MDEtNWQ5ZjI1NzAtMDM0MS00NmFmLTlhMDgtNjg4M2Y3ZWRlZjgyIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2Z1LWhhby15aS1taW4tcmFuZy1kYS1sdS1qaW5nLWppLWJlbmcta3VpLThjaGVuZy13YW5nLXlvdS16aHUtemhhbmctc2hlLXhpYW4uaHRtbCIsIm1vZGUiOjEsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpbeyJzZWN0aW9uSWQiOiI3N2E5YzIyZi1hYzAyLTQ1ZGQtOTZiYy1iMDg5NmE4YTdkNWEiLCJzZWN0aW9uTmFtZSI6IkFQX0xfRF9BUlRJQ0xFXzcyOFgyNTBfNzdhOWMiLCJzdGF0dXMiOjEsIm5ldHdvcmsiOiJhZHBUYWdzIiwibmV0d29ya0FkVW5pdElkIjoiQURQXzQyNzUzXzcyOFgyNTBfNzdhOWMyMmYtYWMwMi00NWRkLTk2YmMtYjA4OTZhOGE3ZDVhIiwic2VydmljZXMiOlsxLDNdLCJhZFVuaXRUeXBlIjoxfV19&c_b=4446.599999904633
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:47 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 426ms
179ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjU2ODE2NDY4ODEsInBhY2tldElkIjoiMDAwMEE3MDEtNWQ5ZjI1NzAtMDM0MS00NmFmLTlhMDgtNjg4M2Y3ZWRlZjgyIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2Z1LWhhby15aS1taW4tcmFuZy1kYS1sdS1qaW5nLWppLWJlbmcta3VpLThjaGVuZy13YW5nLXlvdS16aHUtemhhbmctc2hlLXhpYW4uaHRtbCIsIm1vZGUiOjEsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpbeyJzZWN0aW9uSWQiOiJkMWMxMGE3Mi0yN2I0LTQ5MzEtOGNlNy05OWExOGViYmRiYWUiLCJzZWN0aW9uTmFtZSI6IkFQX0lfRF9BUlRJQ0xFXzcyOFg5MF9kMWMxMCIsInN0YXR1cyI6MSwibmV0d29yayI6ImFkcFRhZ3MiLCJuZXR3b3JrQWRVbml0SWQiOiJTVElDS1lfQURQXzQyNzUzXzcyOFg5MF9kMWMxMGE3Mi0yN2I0LTQ5MzEtOGNlNy05OWExOGViYmRiYWUiLCJzZXJ2aWNlcyI6WzUsM10sImFkVW5pdFR5cGUiOjN9XX0%3D&c_b=4450.799999952316
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:47 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 416ms
171ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjU2ODE2NDY4ODMsInBhY2tldElkIjoiMDAwMEE3MDEtNWQ5ZjI1NzAtMDM0MS00NmFmLTlhMDgtNjg4M2Y3ZWRlZjgyIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2Z1LWhhby15aS1taW4tcmFuZy1kYS1sdS1qaW5nLWppLWJlbmcta3VpLThjaGVuZy13YW5nLXlvdS16aHUtemhhbmctc2hlLXhpYW4uaHRtbCIsIm1vZGUiOjEsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpbeyJzZWN0aW9uSWQiOiIxMDRiMjgyYS1iZDExLTRkOGQtYWQ2NC0wNDkyMDYzYjZjYmEiLCJzZWN0aW9uTmFtZSI6IkFQX0lfRF9BUlRJQ0xFXzEyMFg2MDBfMTA0YjIiLCJzdGF0dXMiOjEsIm5ldHdvcmsiOiJhZHBUYWdzIiwibmV0d29ya0FkVW5pdElkIjoiU1RJQ0tZX0FEUF80Mjc1M18xMjBYNjAwXzEwNGIyODJhLWJkMTEtNGQ4ZC1hZDY0LTA0OTIwNjNiNmNiYSIsInNlcnZpY2VzIjpbNSwzXSwiYWRVbml0VHlwZSI6M31dfQ%3D%3D&c_b=4454.299999952316
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:47 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 block.jpg
delivery.adrecover.com/ 631 B
915 B 333ms
333ms Image
image/jpeg 184.87.193.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://delivery.adrecover.com/block.jpg?ts=1665681646902
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.87.193.92 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-87-193-92.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 /
Resource Hash: 9284d948e86d2e99f31483b5f4b3a4c3e65e0a6fbca9a8d2db8c6095f82ac3f5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: AU
date: Thu, 13 Oct 2022 17:20:46 GMT
last-modified: Wed, 23 Jun 2021 06:37:54 GMT
server: nginx/1.18.0
etag: "60d2d6c2-277"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 631
expires: Thu, 13 Oct 2022 18:20:46 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 38ED 379 B
313 B 426ms
177ms Script
text/javascript 74.125.130.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/show_ads_impl_fy2021.js?bust=31070320

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sb-in-f154.1e100.net

Software

cafe /

Resource Hash

ca09023e332872150e89912fbbbe90fa67575665e9a216f356ea7b39d72c18e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ Frame 38ED 107 B
165 B 438ms
179ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/show_ads_impl_fy2021.js?bust=31070320

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 38ED 107 B
122 B 421ms
172ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/show_ads_impl_fy2021.js?bust=31070320

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 11BD 23 KB
10 KB 480ms
479ms Document
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/show_ads_impl_fy2021.js?bust=31070320

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f03a35bc204badf5893a1c85e33cf1a35451256e37cbcf6c14103a7e359c69f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9937
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:47 GMT
expires: Thu, 13 Oct 2022 17:20:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_2022100602.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
128 KB 180ms
180ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea6e8403bf62c55c1954717c65e41068390e120cab9878cb6851b64cf4b011d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 21:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72919
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131300
x-xss-protection: 0
last-modified: Wed, 12 Oct 2022 15:58:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 12 Oct 2023 21:05:28 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 109 B
118 B 515ms
173ms XHR
application/json 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57ba9c79273602051bd0fa9f6dcd52a3f199dc59f134308efeeaad35424b8311

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93
x-xss-protection: 0
expires: Thu, 13 Oct 2022 17:20:47 GMT

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ Frame 17BE 107 B
165 B 175ms
174ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 17BE 107 B
122 B 171ms
171ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 17BE 492 B
265 B 208ms
207ms XHR
text/plain 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=159797973247066&correlator=4414800227488681&eid=31068919&output=ldjh&gdfp_req=1&vrg=2022100602&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-38&fsapi=false&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1665681647277&lmt=1644386353&dlt=1665681645748&idt=1509&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=sbm0bmr7b0rq&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=673901477.1665681647&ga_sid=1665681647&ga_hid=1832996616&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58fbbc1cb6af191ea0c8410903bc5ece44545d1a13ae0123d1a1e1a5ddfca079

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
4887b2acd567bc959375d6358976d4f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F1DE 6 KB
4 KB 517ms
171ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4887b2acd567bc959375d6358976d4f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:47 GMT
expires: Fri, 13 Oct 2023 17:20:47 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 2C3A 3 KB
1 KB 562ms
214ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646357&bpp=13&bdt=1509&idt=489&shv=r20221011&mjsv=m202210040101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=2&ga_vid=2132115411.1665681647&ga_sid=1665681647&ga_hid=1324712338&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1106&biw=1600&bih=1200&isw=336&ish=280&ifk=876476303&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706&oid=2&pvsid=1075327899981005&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221012&fu=4&bc=31&ifi=1&uci=1.io3081os5z2z&fsb=1&dtd=507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 08:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30967
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 08:44:40 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 2C3A 17 KB
7 KB 535ms
188ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47096
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 04:15:51 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2C3A 152 KB
47 KB 519ms
174ms Script
text/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f154.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:47 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2C3A 0
0 190ms
188ms Fetch
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CKMcJ7khIY-HoOu77z7sPkYSMyAWY_NGxXKqEzOSFAcCNtwEQASAAYKXAo4CkAYIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQK9JWasq9ykPqgDAaoE-wFP0N1X5KzVtk4eMj8ylWVY19_MJHhlPJqAwHi4BIX1MobQ8fs9n6CYIXj5GLC9J7IC41KLfuZ9ZD1ownM_BunHN3KpKSg8kdJrJI1hB23-_M8nAZ_0CEO8LbiHqFaNC4iK5oo2kho-PwkYKEfr7j0yZIaEBvthPZr1AjR7UE_AD-5kLLuFct-uPhXdA5ITtHvKjPWOhpi8ABzszMPhs03k098A8a99Xu0a-Yla9ERkw1cYB9tWU16GDUwwf_jkKmzEZo8pN8yaXI5jioYavPQBrgAcMdLFIQY7StOYeFnjB7dj3qGguDZKV2l1tJea5tvnmYaLkWTJNswLnIAGqP7myM36wYOJAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTQ0ODUyMzk0MjU5MjQ3ODcY4swZ&sigh=IHt1lFZNZhA&uach_m=[UACH]&cid=CAQSGwDq26N9k1ZvCx5SpeH1319XeYPcbppo2QKcFRgBIBM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646357&bpp=13&bdt=1509&idt=489&shv=r20221011&mjsv=m202210040101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=2&ga_vid=2132115411.1665681647&ga_sid=1665681647&ga_hid=1324712338&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=1106&biw=1600&bih=1200&isw=336&ish=280&ifk=876476303&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42531706&oid=2&pvsid=1075327899981005&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221012&fu=4&bc=31&ifi=1&uci=1.io3081os5z2z&fsb=1&dtd=507
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 13 Oct 2022 17:20:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 13 Oct 2022 17:20:47 GMT

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 2C3A 0
0 860ms
284ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=k861FJzIC9ACmAJi-C0SAgAAACE5AQwCW-6I5uT8IWU3JEEQ7khIYxOg39i4g5lDEvWaABIAAA&wp=Y0hI7gAOtGEBc_3uAAMCEVPhC5dXODZVVt72Mw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 142606
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame 3B84 178 KB
52 KB 844ms
340ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y0hI7gAOtGEBc_3uAAMCEVPhC5dXODZVVt72Mw&u=%7CYsh76E5Gt8VA58VZPE%2Bcw%2Br7qrnKLkGMny4aF4tx9SQ%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oZ7-4NEldJVPEcquQgoC5ayq1XBwsz6hbCNpksUhOYIG9jsbcdhUPUG57I5SOVDTgZL_d5GIc1_qNby6Rsn2m7LNal9hhxmkCLE6mOEJ8UIVt0ypTrbWbcWrnBzTN7IJ7wPQGacwrUvLldb0CA242oQXfZ2h_yHtk3kOX5lGNwPHFLuYC8ucRzvyjmnf0Gu0YnXn6b4MEltrmfToL4ishgWdPI_EHIFGQEYH66sXdzd1vk9V3abqcVYJQTfzyFkcSIvNNEj1HcSbZd7Rm5DLqObXw211AW_drZ7YjYTwJ9-4i3H7CvMvU1oBre5nKYBHMCCXL-MBL8A-mXdfHdvU2umdrc-MYZxAEI-bzTo1pyrJUiYUkW8PxPueV_l49Rsq6bdDJFLSvvD8fZobBqDfu0hwl_URW29qOAu1X3UFdM1GLieoOOPmv0gkVljQjp3GEoKbS_1p13ku3OLEAzA89atYcXyoQvafcizlOz6Dk8pR6w17fhLZ5ZjZBe19-kZ2_DjxvLQAM_5q0X52NF_xVZ8XB2UkrSNeKNvluv0q7pvTteqJW8Ir4044_3-L_XcYkZw4LePOIhP9Rp1qUNNEhU0Vba8Z_NnsK7WHCxDvQ_lg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCO6MM7khIY-HoOu77z7sPkYSMyAWY_NGxXKqEzOSFAcCNtwEQASAAYKXAo4CkAYIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQK9JWasq9ykPqgDAaoE_gFP0N1X5KzVtk4eMj8ylWVY19_MJHhlPJqAwHi4BIX1MobQ8fs9n6CYIXj5GLC9J7IC41KLfuZ9ZD1ownM_BunHN3KpKSg8kdJrJI1hB23-_M8nAZ_0CEO8LbiHqFaNC4iK5oo2kho-PwkYKEfr7j0yZIaEBvthPZr1AjR7UE_AD-5kLLuFct-uPhXdA5ITtHvKjPWOhpi8ABzszMPhs03k098A8a99Xu0a-Yla9ERkw1cYB9tWU16GDUwwf_jkKmzEZo8pN8yaXI5jioYavPQBrgAcMdKHIyeprx0RBqZqdimIiDtjkSJAwGNbrH8SFY19UDiVvXwu3V11Y2PNwIAGqP7myM36wYOJAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3R2boWa7FMEy5h26BC3M-TxOGayA%26client%3Dca-pub-4485239425924787%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

fc31961b1361c27b84c015892f76b625a8c763d7d0ffdb3bb5675db352deb6af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:47 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=x5478iPHRShdgZIC0hRD6lJ2tDZPMylaDuhx2G_WyW0OFInx1-q35KEG8wamZ9ewkbFb-RPt7ctIW-CdelERcbPGAZrTJlWoVLcWGne37kfvUBZ1UCkC8MI7BvSE05UAHdjShhBY9IRhb1vyIE1l-X0oDIPFmcRc6BLdLnjisi2cMz6_24z5Xf04egkBA9Eet1H2NtWIl6nWuKFLhGZjaAYoicmKFYVN-fouHiBJAjShxwUr6ToMidgqORKwyDzcTbVN0atMdYATYB86"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 98465595
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame E2DC 63 KB
23 KB 173ms
172ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a139caebc5a7c4bf78945ba3f22a3ae9981e5e8d6f10a2f6235d07a438eb0c41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 16:31:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2957
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23659
x-xss-protection: 0
server: cafe
etag: 898360552121563568
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 13 Oct 2022 17:31:30 GMT

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ Frame E2DC 107 B
165 B 476ms
175ms Script
application/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame E2DC 107 B
122 B 172ms
171ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame E2DC 492 B
266 B 204ms
204ms XHR
text/plain 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=745880136801479&correlator=1521963076160924&eid=31068458%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=2022100602&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-38&fsapi=false&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1665681647444&lmt=1644386353&dlt=1665681645769&idt=1663&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=8vl5x9webu76&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&rumc=745880136801479&rume=1&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=1663505072.1665681647&ga_sid=1665681647&ga_hid=117866344&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

301c566f54ff7ac12b3352bcb4cc4802f142b7d81e26651a9a165152ea34888d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 235
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
4d50bd63e279e714e7fb1fd611c526e2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 750D 6 KB
4 KB 525ms
175ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d50bd63e279e714e7fb1fd611c526e2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:47 GMT
expires: Fri, 13 Oct 2023 17:20:47 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 11BD 3 KB
1 KB 467ms
213ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 08:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30967
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 08:44:40 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 11BD 17 KB
8 KB 424ms
171ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47096
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 04:15:51 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 11BD 152 KB
46 KB 669ms
417ms Script
text/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f154.1e100.net

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:47 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 11BD 0
0 184ms
183ms Fetch
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CHFRD70hIY5qqA7aoz7sPkMezyASY_NGxXKqEzOSFAcCNtwEQASAAYKXAo4CkAYIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQKGbyuXgxylPqgDAaoE9QFP0OqqztF2D0-OAdsyJFIMwhqSWZR4zorMIl9DVXxsK_m4TXb3vIayGgglu2-BitWP9xQnSQE2Q5LD3SwUqS3rAuNyf50Poq2NNZWAnW2DL00vJ8YclFvAGIgsuwwxR0p32DB3RvgyAvY86g3btaoQIthxOFM9HgHmIEk15nL8VoUNlCbPhxj0NhmKyB8mSyVXa1jFSucCz5FaBzb97XcO6NX0bxEaL8ntKVJqjndK2kClRmcPOjUa2wHTs3olaE4KJkiDHua8Ktx35nNqIDGjRBDjGhOqPI1C_9SOiBn1rvQ8XX_HQu5y-zMh6LVDqvzQYhLPVYAGl-WiuNGt1ZD0AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTQ0ODUyMzk0MjU5MjQ3ODcY4swZ&sigh=nLWk7mZ6v8I&uach_m=[UACH]&cid=CAQSGwDq26N96oZ1zJA-2MorGyx2QKbpD53lUQYZUBgBIBM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 13 Oct 2022 17:20:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 13 Oct 2022 17:20:47 GMT

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 11BD 0
0 766ms
285ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=k4XhE5zIC9ACmAJi-C0SAgAAACE5AQwCW-6I5uT8IWU3JEEQ7khIY6O5poiVcfvxjk9uABIAAA&wp=Y0hI7wAA1RoBc9Q2AAzjkP35o85Vhzwet9oU0Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:47 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 129281
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame 1BE9 40 KB
16 KB 749ms
339ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y0hI7wAA1RoBc9Q2AAzjkP35o85Vhzwet9oU0Q&u=%7CYsh76E5Gt8UTeDjeiU4WXoVFLlqJHi69ewHdWwo8cgE%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oZ7-4NEldJVPEcquQgoC5ayq1XBwsz6hbCNpksUhOYIG9jsbcdhUPUG57I5SOVDTghiXWofN_8lNbU060t5U1xZZ1eiHhnpGdQuCrmvrpPqIW7Ih87bO1pKI3SHJy88OQ6tJRYYE15UBIFWOavmQabdhHIfEizfSvNSIUShcP28zBfLaAb_GHyJvfN-w0xrhsnvc5HI9YVo7hCrX-wYc9hHzPxRTlznpr4NbW30Fbq5FZDmoDpAfP0ZzKsUYnHtuUkWJBoOu5E0tNmdieX-j03f3EarGj-JZDe-148pEQyz5vrQ-H4oPtozhh6nDZc1DE2zt_DlJZxj56JwHXtdW_-PMnys4X2_qdPqEhdXCLd1xzTboKif0gRv1qXSM-wNfGgwdJdLp94-9YG7w3J-CD_IpJ7glsdf6Lyo2Ui4eOHBKF9Nncqgsyrp_fE8j-hDicofEVULOA5V6B6ss6js_wz7--f0LsW0vqMdtSPg3WOv3tH6HDtXZiNx4ILhddXacwuS6nMrHXaO-nywRbaoAUn5WhbLWiBpUnAbscCK91mJCU5sfdB7X2wb-Fex_ASn5EHQNQ6iF8ORAL6sx4a2VuSUi0CSL65c3WoKVzd_fbFlo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXHO-70hIY5qqA7aoz7sPkMezyASY_NGxXKqEzOSFAcCNtwEQASAAYKXAo4CkAYIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQKGbyuXgxylPqgDAaoE-AFP0OqqztF2D0-OAdsyJFIMwhqSWZR4zorMIl9DVXxsK_m4TXb3vIayGgglu2-BitWP9xQnSQE2Q5LD3SwUqS3rAuNyf50Poq2NNZWAnW2DL00vJ8YclFvAGIgsuwwxR0p32DB3RvgyAvY86g3btaoQIthxOFM9HgHmIEk15nL8VoUNlCbPhxj0NhmKyB8mSyVXa1jFSucCz5FaBzb97XcO6NX0bxEaL8ntKVJqjndK2kClRmcPOjUa2wHTs3olaE4KJkiDHua8Ktx35nNqIDHhRjFx_90jQnLLjkpl3oM2h-A2ynXpWgb6CGW7IQtdhuQ3iYOxqrS1nYAGl-WiuNGt1ZD0AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1C7_yn_RTnXUz3SBPLAmtgE4Nbiw%26client%3Dca-pub-4485239425924787%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1665681646&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665681646435&bpp=12&bdt=1602&idt=504&shv=r20221012&mjsv=m202210120101&ptt=5&saldr=sa&correlator=7846859594148&frm=23&ife=1&pv=1&ga_vid=203208625.1665681647&ga_sid=1665681647&ga_hid=1500249622&ga_fc=0&ga_cid=amp-UBC05d4z3uBSF4l475Zznw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=625808887&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070320%2C44774292%2C31068921&oid=2&pvsid=4393964291990564&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&alvm=r20221011&fu=4&bc=31&ifi=1&uci=1.hmcueau2fgni&fsb=1&dtd=520

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

a19672fc80b21ce691312b60c164c5c9c728a4dd5e9a1db72b212de88ca4c820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:47 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=_ayz9SPHRShdgZIC0y800QWbqWNGyQ2A3mLJlbahFP2BXaNoiwjnpCjgv0DV9cdSonS_jLbq-pdTZhkLurUOfXsCpLQL6sRGMwSQlBohxcjrdsm8XmyYU1Q3iSXedPa0he_-wMXKrNy4tFxqfJKvLmVVWUfaBtHbc94wvbRqWz9iaIR-vhNTdhw9Ijnf95Edez5X3d61CVXYuiTR6cHOM5Q_EYCow0kgHXZ38NYrEAGeo4NGTlvg7-MDzQf_LZAMKaguzw85xrVRwYlU"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 2884645
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 quant.js Show response
secure.quantserve.com/ 26 KB
10 KB 631ms
170ms Script
application/javascript 103.229.10.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.10.192 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e7aaa31aec9d6a9f88c0af5d361aff3e7828ace0fb0c55ab35922025e12700b1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
etag: "cbFpuah7ilcpMTJLYeCgng=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Thu, 20 Oct 2022 17:20:48 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 17BE 14 KB
11 KB 477ms
176ms XHR
application/json 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022100602&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d6707b8da37cbd1957477c87ceb9358eccac72ccbe7bebd96ae0875f0bd9100

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11105
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 11BD 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d2bf98106a7aa175879fa9a6ce5decfeddbed7348ca67f0e6f069b57d956de0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 2C3A 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0819428b9ad6cb917fa3a858d076ae6a450a5d1aa08e4d05d3e3da38dbc77320

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame E2DC 14 KB
11 KB 356ms
180ms XHR
application/json 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022100602&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dba52430f3af227499037e56c11be9c3a9490bd682ed30c710254119bd77bb27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11182
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E2DC 0
20 B 171ms
170ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=cdn.aralego.net&doc=complete&pg_h=0&pg_w=0&pg_hs=0&c=0&aa_c=0&dt=d

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-54Nt-1NAaEEe0.js Show response
rules.quantcount.com/ 160 B
614 B 592ms
171ms Script
application/javascript 13.33.33.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-118.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:02:11 GMT
via: 1.1 54d4d00f5a92073c1a23e29f92000462.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-P1
age: 1117
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 15:29:19 GMT
server: AmazonS3
etag: "05b131079c67d484167fd1b1f6c79577"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: p3-lGLYwZ_qs6WiHw4cCLZRNi2b1xSLD8pzhd__29VmuHUIgqQtvKw==

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 1BE9 2 KB
1 KB 514ms
169ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y0hI7wAA1RoBc9Q2AAzjkP35o85Vhzwet9oU0Q&u=%7CYsh76E5Gt8UTeDjeiU4WXoVFLlqJHi69ewHdWwo8cgE%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oZ7-4NEldJVPEcquQgoC5ayq1XBwsz6hbCNpksUhOYIG9jsbcdhUPUG57I5SOVDTghiXWofN_8lNbU060t5U1xZZ1eiHhnpGdQuCrmvrpPqIW7Ih87bO1pKI3SHJy88OQ6tJRYYE15UBIFWOavmQabdhHIfEizfSvNSIUShcP28zBfLaAb_GHyJvfN-w0xrhsnvc5HI9YVo7hCrX-wYc9hHzPxRTlznpr4NbW30Fbq5FZDmoDpAfP0ZzKsUYnHtuUkWJBoOu5E0tNmdieX-j03f3EarGj-JZDe-148pEQyz5vrQ-H4oPtozhh6nDZc1DE2zt_DlJZxj56JwHXtdW_-PMnys4X2_qdPqEhdXCLd1xzTboKif0gRv1qXSM-wNfGgwdJdLp94-9YG7w3J-CD_IpJ7glsdf6Lyo2Ui4eOHBKF9Nncqgsyrp_fE8j-hDicofEVULOA5V6B6ss6js_wz7--f0LsW0vqMdtSPg3WOv3tH6HDtXZiNx4ILhddXacwuS6nMrHXaO-nywRbaoAUn5WhbLWiBpUnAbscCK91mJCU5sfdB7X2wb-Fex_ASn5EHQNQ6iF8ORAL6sx4a2VuSUi0CSL65c3WoKVzd_fbFlo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXHO-70hIY5qqA7aoz7sPkMezyASY_NGxXKqEzOSFAcCNtwEQASAAYKXAo4CkAYIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQKGbyuXgxylPqgDAaoE-AFP0OqqztF2D0-OAdsyJFIMwhqSWZR4zorMIl9DVXxsK_m4TXb3vIayGgglu2-BitWP9xQnSQE2Q5LD3SwUqS3rAuNyf50Poq2NNZWAnW2DL00vJ8YclFvAGIgsuwwxR0p32DB3RvgyAvY86g3btaoQIthxOFM9HgHmIEk15nL8VoUNlCbPhxj0NhmKyB8mSyVXa1jFSucCz5FaBzb97XcO6NX0bxEaL8ntKVJqjndK2kClRmcPOjUa2wHTs3olaE4KJkiDHua8Ktx35nNqIDHhRjFx_90jQnLLjkpl3oM2h-A2ynXpWgb6CGW7IQtdhuQ3iYOxqrS1nYAGl-WiuNGt1ZD0AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1C7_yn_RTnXUz3SBPLAmtgE4Nbiw%26client%3Dca-pub-4485239425924787%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 1BE9 2 KB
1 KB 518ms
174ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 1BE9 308 B
636 B 505ms
170ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 1BE9 293 B
621 B 506ms
172ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame 1BE9 43 B
347 B 515ms
173ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=pwKnaqVwL7YB83wwQLaOx8MZCpc5_WUt5-0Hf4-tBhQRbMZMB3KDnlIEBNOckPb1BLdolqYQ0ATHncmgXRSlu9h0KRd4H6RIuf6Z5A9CcrFANxgH-aenNA1vKq_fbwff8bS1m5mS0emyMx0ohEMXTpCFo4Dr3hNU1bkc1WLztX58eiIDfCCR0eGvthMVFYG9qaJhy07dk7Utd2iohdw8NrWap2BXZVMzrvEfI2Y8jhl_hXIDDnWwNVNFsdFBNcISiGD2VWikkC_UKKDCsHRYjEq3cKArfaXtD5Wnh4NH9KLD2AopUN97Rl7Sr33tP-0CDEKms7bwsv-PHwR5BB-yqAU1kC4ULJdqvVtIsNW4NsklJfp8qU_3fWuj2eVoCjvcTmgvzW0Ew3xNsjETttgAR57heibF6ydAhOE6klFpjaDjePiYPnIRLrdp2siwzoaLFndzkQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2960175
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 3B84 2 KB
1 KB 674ms
338ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y0hI7gAOtGEBc_3uAAMCEVPhC5dXODZVVt72Mw&u=%7CYsh76E5Gt8VA58VZPE%2Bcw%2Br7qrnKLkGMny4aF4tx9SQ%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oZ7-4NEldJVPEcquQgoC5ayq1XBwsz6hbCNpksUhOYIG9jsbcdhUPUG57I5SOVDTgZL_d5GIc1_qNby6Rsn2m7LNal9hhxmkCLE6mOEJ8UIVt0ypTrbWbcWrnBzTN7IJ7wPQGacwrUvLldb0CA242oQXfZ2h_yHtk3kOX5lGNwPHFLuYC8ucRzvyjmnf0Gu0YnXn6b4MEltrmfToL4ishgWdPI_EHIFGQEYH66sXdzd1vk9V3abqcVYJQTfzyFkcSIvNNEj1HcSbZd7Rm5DLqObXw211AW_drZ7YjYTwJ9-4i3H7CvMvU1oBre5nKYBHMCCXL-MBL8A-mXdfHdvU2umdrc-MYZxAEI-bzTo1pyrJUiYUkW8PxPueV_l49Rsq6bdDJFLSvvD8fZobBqDfu0hwl_URW29qOAu1X3UFdM1GLieoOOPmv0gkVljQjp3GEoKbS_1p13ku3OLEAzA89atYcXyoQvafcizlOz6Dk8pR6w17fhLZ5ZjZBe19-kZ2_DjxvLQAM_5q0X52NF_xVZ8XB2UkrSNeKNvluv0q7pvTteqJW8Ir4044_3-L_XcYkZw4LePOIhP9Rp1qUNNEhU0Vba8Z_NnsK7WHCxDvQ_lg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCO6MM7khIY-HoOu77z7sPkYSMyAWY_NGxXKqEzOSFAcCNtwEQASAAYKXAo4CkAYIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQK9JWasq9ykPqgDAaoE_gFP0N1X5KzVtk4eMj8ylWVY19_MJHhlPJqAwHi4BIX1MobQ8fs9n6CYIXj5GLC9J7IC41KLfuZ9ZD1ownM_BunHN3KpKSg8kdJrJI1hB23-_M8nAZ_0CEO8LbiHqFaNC4iK5oo2kho-PwkYKEfr7j0yZIaEBvthPZr1AjR7UE_AD-5kLLuFct-uPhXdA5ITtHvKjPWOhpi8ABzszMPhs03k098A8a99Xu0a-Yla9ERkw1cYB9tWU16GDUwwf_jkKmzEZo8pN8yaXI5jioYavPQBrgAcMdKHIyeprx0RBqZqdimIiDtjkSJAwGNbrH8SFY19UDiVvXwu3V11Y2PNwIAGqP7myM36wYOJAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3R2boWa7FMEy5h26BC3M-TxOGayA%26client%3Dca-pub-4485239425924787%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 3B84 2 KB
1 KB 508ms
172ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 3B84 308 B
636 B 499ms
173ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 3B84 293 B
621 B 665ms
339ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame 3B84 43 B
348 B 505ms
172ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=Pvis_u8k-x8deb9oStpNzgMQ_za_CQNd2qUoWWp1K_vYiDNWS8AZq9sA8zsdVcv6ZDC4GdnPHi3YZlmiEWy6kHEswMECA5RxIvYkald_lWpqMcFslrknMBjjTJTtaY54_FVbGb1Ps16ox3pS8eFVeWvOAyp_hXtS2aSZdgjrouJrHnf6CpAjBC3KroCC7FOBhuCBoaUxF7bCoeAchxC2_4DdzcVLs-mQNiilY9479lC5B2w2_v9bnlYCx0dIzLnJ0oCGVYpIucL10Ze3rdrKkbKxSujI-Ym07-vu-Zf6AvbB6fUo4MAvofOgJEVlh1x1M35jn9YRnEYopTRklGy8wpC2fn_dGRKrgTd3zE2BG_YH-PilxdhpvElPbzN7NhbNiZdDJwTd4g4Sq-JvJYqeMzRwU8N2IzodIel8r6wBqZOsKfRB

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1624227
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 index.html Show response
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/ Frame 2982 2 KB
1 KB 502ms
171ms Document
text/html 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

2a42afe3f95e065e32f837ef95125257c1e16f6464cb981b1b5e6faae2a5fae5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=31104000 public
content-encoding: gzip
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:48 GMT
etag: W/"62bcee38-66d"
expires: Sun, 08 Oct 2023 17:20:48 GMT
last-modified: Thu, 30 Jun 2022 00:28:40 GMT
server: nginx
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

POST
H2 200 all
csm.as.criteo.net/ Frame 1BE9 0
128 B 517ms
171ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=_ayz9SPHRShdgZIC0y800QWbqWNGyQ2A3mLJlbahFP2BXaNoiwjnpCjgv0DV9cdSonS_jLbq-pdTZhkLurUOfXsCpLQL6sRGMwSQlBohxcjrdsm8XmyYU1Q3iSXedPa0he_-wMXKrNy4tFxqfJKvLmVVWUfaBtHbc94wvbRqWz9iaIR-vhNTdhw9Ijnf95Edez5X3d61CVXYuiTR6cHOM5Q_EYCow0kgHXZ38NYrEAGeo4NGTlvg7-MDzQf_LZAMKaguzw85xrVRwYlU&sds=2&rev=83153&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 1BE9 2 KB
1 KB 661ms
339ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 1BE9 2 KB
1 KB 674ms
352ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 3B84 12 KB
5 KB 271ms
92ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 75120
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0YGkeLS7ZqiECmCFOTa95pTPGRWL54uhUJ6CiFqW1FeG5jGpr7VEw4DqzNpvTGXAdCY6So3WKWOjFzqP8HCpWN3QVsf7xC%2FpmLVnb76nN7qcjZTkE9vJPopze1wcFUkgPuovz299"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7599bf7f39d75a61-MEL
expires: Tue, 03 Oct 2023 17:20:48 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 17BE 17 KB
7 KB 472ms
171ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-41-101-164.us-west-2.compute.amazonaws.com

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:48 GMT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 270ms
93ms XHR
application/json 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20221013

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

248ca841b0643dafae9fbd3be2627228127bbff82c356ea4b6afefe6160dd85e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8362
x-jsd-version: 1.0.1491
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19153-FRA, cache-yyz4581-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"669-8ES4XDTN+KC7/Egu+DycpwKwEJs"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a6HKN7fWfu%2FKBXP9TCqJDw4qMHVBKONpDSfSva6e%2FrOkIkwwcV4yjC0FKjTpWqfHcn56W2T8ezguNL53EaZLVQ5e69MVEnPY9p%2FQ5eSSnoc9djvczsg8IeHe4doN5DvOPR0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 7599bf7f89025a91-MEL

POST
H2 200 adreq Show response
ads.servenobid.com/ 405 B
552 B 1076ms
358ms XHR
application/json 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=4850
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 91a8ea37de90c116390b167dfc281ce0ed7e8f324ff1fd834bb27aca9db191db

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 23 B
360 B 875ms
232ms XHR
application/json 35.213.117.18
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.117.18 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 18.117.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 800136b5922c3f1269fdf1937f5f54fc899cc44eb46c32abd83b6efa37f3004d

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 13 Oct 2022 17:20:49 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 48

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
924 B 868ms
691ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUPEPKI9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 94c78ded291bf2b91f6763a876586c92f37e5803136fb3cdb85f9e2385f3df68

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 516
alt-svc: clear

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
520 B 883ms
278ms XHR
application/json 184.25.221.62
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.25.221.62 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-25-221-62.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 13 Oct 2022 17:20:49 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
313 B 457ms
280ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2217f689f6b2fe5bf%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A7%2C%22msi%22%3A7%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2224815014d09a6fe%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22250x250%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2227527c323724aa4%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%22281ffcebe245927%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A120%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%221c9de140-a11f-493d-8a81-64ae0d66b27c%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: beffc0b6a784e2e51f42b9787867b559cccb39a84e6954f4b7034c2a2aeef6a4

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yf5ZGeXOvumd8o35%2FG41TMNqzk%2BwLWDxGF69fOrQy%2BFFyZpKNbyynFSRg3fDBfP6LuSiOZcfZr88p4vQYARWbH7wpJJ4pFyUlzWiRmUA66QWep8n45OROUijSTGEWEpDXpb%2FvqPx"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7599bf7fcb0d5aa0-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
560 B 427ms
251ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2217f689f6b2fe5bf%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2227527c323724aa4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B728%2C90%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A728%2C%22h%22%3A90%7D%7D%2C%7B%22id%22%3A%22281ffcebe245927%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B120%2C600%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A120%2C%22h%22%3A600%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%221c9de140-a11f-493d-8a81-64ae0d66b27c%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: beffc0b6a784e2e51f42b9787867b559cccb39a84e6954f4b7034c2a2aeef6a4

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f9Up7nlnWSohGP0Y9eIS5u0HZrz6836XLLwsp9b7Dlv8fI2u3I8TsWCidZ59uQ1WYMlmmGi7CKwtkyGdtHjs%2Fj37YxZebvM55PBV%2F4NHXqXtE4ZIg1aDdcgG8l4tjcE0TboKN8AS"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7599bf7fcb0f5aa0-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 3 B
517 B 1023ms
331ms XHR
application/json 52.41.101.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&CanonicalUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&PublisherDomain=https%3A%2F%2Fbg3.co%2F

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.41.101.164 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
via: kong/2.8.1
x-content-type-options: nosniff
x-kong-proxy-latency: 0
p3p: CP="CAO PSA OUR"
x-kong-upstream-latency: 7
content-length: 3
pragma: no-cache
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
504 B 787ms
405ms XHR
application/json 13.251.219.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.19.0&referrer=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&tmax=3000

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.251.219.40 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-251-219-40.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
accept-ch: sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 arj Show response
adpushup-d.openx.net/w/1.0/ 174 B
382 B 464ms
286ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=9d2d4f1e-63fc-4371-b841-c6319ab89bcc%2Ccd9c214b-f0b1-4b37-ae75-0c398d51e7f0%2Cdb05902e-33e7-48d3-81e9-7b1344857157&nocache=1665681648383&pubcid=1c9de140-a11f-493d-8a81-64ae0d66b27c&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&aus=728x250%2C728x90%2C690x90%2C690x250%2C675x90%2C675x250%2C670x90%2C670x250%2C650x90%2C650x250%2C650x150%2C630x90%2C630x250%2C602x100%2C600x90%2C600x250%2C580x90%2C570x90%2C550x150%2C468x60%2C320x50%2C320x100%2C300x50%2C300x100%2C300x75%2C300x250%2C250x250%2C200x200%7C728x90%2C690x90%2C675x90%2C670x90%2C650x90%2C630x90%2C600x90%2C580x90%2C570x90%2C468x60%2C320x50%2C300x50%2C300x75%7C120x600&divids=ADP_42753_728X250_77a9c22f-ac02-45dd-96bc-b0896a8a7d5a%2CSTICKY_ADP_42753_728X90_d1c10a72-27b4-4931-8ce7-99a18ebbdbae%2CSTICKY_ADP_42753_120X600_104b282a-bd11-4d8d-ad64-0492063b6cba&aucs=%2C%2C&auid=545618347%2C545618347%2C545618347
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 822ef2951416684c2cb96d7c54ccd4744bc7f6ca1c9b612e9e34a9674c3509da

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 360ms
183ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=2b09f93c-6388-4aef-9ba9-d86af3ce9c63&nocache=1665681648384&pubcid=1c9de140-a11f-493d-8a81-64ae0d66b27c&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=120&vht=600&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
504 B 359ms
182ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=4121cd76-88f4-40cc-a068-726236319baa&nocache=1665681648384&pubcid=1c9de140-a11f-493d-8a81-64ae0d66b27c&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=728&vht=90&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 364ms
188ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=dd1ee30a-6e1f-4b44-9b44-3dc77db607b6&nocache=1665681648384&pubcid=1c9de140-a11f-493d-8a81-64ae0d66b27c&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=400&vht=225&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 584 B
863 B 1074ms
447ms XHR
application/json 145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 60290339a2b21c38dfc0b0d87d2e37cd20777f6f2842bd3fc8e8ac79311ab8a2

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 136
content-length: 301

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
212 B 589ms
240ms XHR
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.19.0&cb=29543927416

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
547 B 829ms
484ms XHR
application/json 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://www.bg3.co
content-type: application/json
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 49 KB
13 KB 1080ms
457ms XHR
application/json 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

66edf30f6d947945926425eb9ad7550af3edb22b18de2fccc85805b0e8bc5415

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 13 Oct 2022 17:20:49 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: ed673395-bad9-4815-9a0d-13cf84521a5e
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
406 B 1022ms
391ms XHR
application/json 52.192.146.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.192.146.105 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-192-146-105.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: d3a9874103a5faaba7c116c8bc1043f62641e1333c457235ec6a900bdede1280

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-prebid: pbs-java/1.101.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
407 B 962ms
332ms XHR
application/json 52.192.146.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.192.146.105 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-192-146-105.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: f39fada4e588ee6d6025c7ad82f2625523ab4f37bec21424f98590d79a328c14

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-prebid: pbs-java/1.101.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
406 B 1181ms
551ms XHR
application/json 52.192.146.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.192.146.105 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-192-146-105.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 21229d0386a2941afcb8cdec8b716457bb221e29d1d9d16706b4eecc09669d5b

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-prebid: pbs-java/1.101.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 472 B
2 KB 766ms
246ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20616&site_id=395958&zone_id=2209398&size_id=15%3B2%3B8&alt_size_ids=2%2C1%2C13%2C14%2C19%2C43%2C44%2C117%3B1%2C43%2C44%3B&rp_schain=1.0,1!adpushup.com,062d9a21f747ddee7c25d4297776e0aa,1,,,&eid_pubcid.org=1c9de140-a11f-493d-8a81-64ae0d66b27c%5E1&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&tk_flint=pbjs_lite_v6.19.0&x_source.tid=a5977380-e9b1-4136-b7e8-a3e7f1ea8700%3Bc6573adb-69d7-45e1-b84b-0097b0c745b4%3Be7a15920-2133-4e17-aa0f-86ffca1cee51&l_pb_bid_id=71822e52a945949%3B72eabd9ee23a6b%3B737943ba23a0843&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=3&rand=0.5674503642262445
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 309bb34b7d65c6c425a531b8203b2b39f12550c93a0f9887966d0c24dbec02b6

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:49 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://www.bg3.co
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 472
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame E2DC 17 KB
6 KB 436ms
172ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:48 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 3B84 12 KB
6 KB 500ms
375ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 13 KB
13 KB 677ms
335ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?h=92&m=0&partner=98328&q=80&r=0&u=http%3A%2F%2Fstatic.sg1.as.criteo.net%2Fdesign%2Fdt%2F98328%2F220804%2F7ba2d22d6eed4b5d84faf95670d20a8d_bubba_bump_logo.png&v=3&w=668&s=EfE6JGDlweYYu1IJtH0g7XjK

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

4f717ef7b790e028b442121ad67d8aacceda3e7b282ead53d5453379d559e424

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=27699153
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13021
expires: Wed, 30 Aug 2023 07:33:22 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 10 KB
10 KB 899ms
557ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2Fimage_c8a6b36a-e7da-4280-ae89-2eb11b7d2f84.jpg%3Fv%3D1619507363&v=3&w=400&s=g1ZuU7kV5HxTgtr8ADrk6EWa&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e193c3f531725de78245df333ed3f2bc506dd1410e64c11496adf7f657f08222

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=27167200
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9956
expires: Thu, 24 Aug 2023 03:47:29 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 17 KB
17 KB 690ms
349ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2Fimagejpg_77b92e10-054c-4d6f-bfdc-351f95fda0b3.jpg%3Fv%3D1619510634&v=3&w=400&s=GuXozFsCSRzH4loDtT66jQ5H&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

4c54a7167d8f46db25633861195e63418e352c2901317be7c962edb16325f67c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28161753
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 17404
expires: Mon, 04 Sep 2023 16:03:22 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 6 KB
6 KB 899ms
558ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2FPhoto15-5-2022_40433pm.jpg%3Fv%3D1655857267&v=3&w=400&s=a5ck12tih9CLOYd6fPNgDXEr&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

4aa42be079bfc011cf59c7bef2563884c508d39620b87e4005c29de83f812033

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28153578
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5754
expires: Mon, 04 Sep 2023 13:47:07 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 16 KB
16 KB 932ms
592ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2FPhoto22-1-21_125858pm_1.jpg%3Fv%3D1619506715&v=3&w=400&s=xIS7rFkyQkt-gzf1DfQoCq2u&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

18b4e5e95f755ada7152b380f93284a12bec400dd9ebc97b01c640be5f467f99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28818166
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16500
expires: Tue, 12 Sep 2023 06:23:35 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 22 KB
23 KB 844ms
504ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2FPhoto_22-10-19_10_37_10_am_preview.jpg%3Fv%3D1619509853&v=3&w=400&s=oQw71t93eCnD_IKonouegwMu&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

7146ccf293e469c73971bd5a9c601fea78d929ff83bb4f85d048c2e3e015f282

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28160481
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 22850
expires: Mon, 04 Sep 2023 15:42:10 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 15 KB
15 KB 510ms
510ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2Fimage_79792bb0-2b26-4503-9a06-5ddd6c01e599.jpg%3Fv%3D1658881305&v=3&w=400&s=j28KqqJMzb80zWQydKEzKocK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

4aed34d69922310ac61fd1d7684138b37f5356a92b4ab9b1206ed5cd6f9d3dcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28337617
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 15442
expires: Wed, 06 Sep 2023 16:54:26 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 3 KB
3 KB 574ms
573ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2F121A0927.jpg%3Fv%3D1656462089&v=3&w=400&s=uO45W5sdiMPRgRlVucMVwkKp&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

88974e9fa2ae8eef6a3cda59172bf279353a7110a9f9bc0ebdb1db5948514aa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28256343
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3030
expires: Tue, 05 Sep 2023 18:19:52 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 4 KB
4 KB 589ms
589ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2F121A0892-2.jpg%3Fv%3D1655252473&v=3&w=400&s=jnFu11HTiiN6FQTLQ_hP2XXJ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

fbe2e4551f4262fbd3dbfcfd111f8d247e5a79f1f3626604eafd5ca6428df89b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28818531
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3842
expires: Tue, 12 Sep 2023 06:29:40 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 3B84 11 KB
11 KB 590ms
590ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=98328&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0041%2F5016%2F5622%2Fproducts%2F2_0b1d3b8e-1dd2-4b00-919c-d2af1f14fcfe.png%3Fv%3D1661758983&v=3&w=400&s=9jaug0E9avYEuFZ9n1dxY50j&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

13a0808aa1d705ca7a3881cb67d8d6e28f99da10083c43fb03ca2981df5897c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=27639251
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10924
expires: Tue, 29 Aug 2023 14:55:00 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame 3B84 0
127 B 172ms
172ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=x5478iPHRShdgZIC0hRD6lJ2tDZPMylaDuhx2G_WyW0OFInx1-q35KEG8wamZ9ewkbFb-RPt7ctIW-CdelERcbPGAZrTJlWoVLcWGne37kfvUBZ1UCkC8MI7BvSE05UAHdjShhBY9IRhb1vyIE1l-X0oDIPFmcRc6BLdLnjisi2cMz6_24z5Xf04egkBA9Eet1H2NtWIl6nWuKFLhGZjaAYoicmKFYVN-fouHiBJAjShxwUr6ToMidgqORKwyDzcTbVN0atMdYATYB86&sds=2&rev=83153&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 3B84 2 KB
1 KB 345ms
340ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 3B84 2 KB
1 KB 199ms
198ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

POST
H2 204 log
aplogger.adpushup.com/ 0
54 B 818ms
219ms Ping
text/plain 104.211.156.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=glimpse_pageView&data=eyJzZXNzaW9uSWQiOiI2NTQ0ODBfMTY2NTY4MTY0ODQ3NiIsInVzZXJJZCI6IjgyNTA3NV8xNjY1NjgxNjQ4NDc2Iiwic2l0ZUlkIjo0Mjc1MywicGxhdGZvcm0iOiJERVNLVE9QIiwicGFnZUlkIjoiNjY1Mzc0XzE2NjU2ODE2NDg0NzYiLCJwYWdlUGF0aCI6IiUyRmElMkZmdS1oYW8teWktbWluLXJhbmctZGEtbHUtamluZy1qaS1iZW5nLWt1aS04Y2hlbmctd2FuZy15b3Utemh1LXpoYW5nLXNoZS14aWFuLmh0bWwiLCJob3N0bmFtZSI6Ind3dy5iZzMuY28iLCJ1cmwiOiJodHRwcyUzQSUyRiUyRnd3dy5iZzMuY28lMkZhJTJGZnUtaGFvLXlpLW1pbi1yYW5nLWRhLWx1LWppbmctamktYmVuZy1rdWktOGNoZW5nLXdhbmcteW91LXpodS16aGFuZy1zaGUteGlhbi5odG1sIiwicGhhc2UiOjAsInVzZXJUeXBlIjoiTkVXIiwicHJldmlld1ZhcmlhdGlvbiI6Im5vUHJldmlld1BhZ2UiLCJleHBlcmltZW50UGFnZSI6ZmFsc2UsInRpbWVzdGFtcCI6MTY2NTY4MTY0ODQ3N30=
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.211.156.162 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 404 L2EvZnUtaGFvLXlpLW1pbi1yYW5nLWRhLWx1LWppbmctamktYmVuZy1rdWktOGNoZW5nLXdhbmcteW91LXpodS16aGFuZy1zaGUteGlhbi5odG1s.json Show response
cdn.adpushup.com/42753/ 555 B
818 B 416ms
416ms XHR
text/html 23.52.171.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/L2EvZnUtaGFvLXlpLW1pbi1yYW5nLWRhLWx1LWppbmctamktYmVuZy1rdWktOGNoZW5nLXdhbmcteW91LXpodS16aGFuZy1zaGUteGlhbi5odG1s.json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.171.82 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-52-171-82.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 /
Resource Hash: 6d83b77c3d8c5c0ccc7078540a1fb0bd9fa43eeb82b89f83264d469aa100c088

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: AU
date: Thu, 13 Oct 2022 17:20:48 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=MISS, edge; dur=14, origin; dur=229
content-length: 555
expires: Thu, 13 Oct 2022 18:20:48 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 3B84 1 KB
913 B 520ms
173ms Stylesheet
text/css 172.253.118.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Karla:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e58bb65e5ce1a00715d3571d44cf9040e3f2cc2bc2f6eae3e2caa25607fb0d50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 17:20:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 13 Oct 2022 17:20:49 GMT

GET
H2 200 pixel;r=2019478498;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc...
pixel.quantserve.com/ 35 B
372 B 247ms
172ms Image
image/gif 103.229.10.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2019478498;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-762824985-1665681648721;pbc=1c9de140-a11f-493d-8a81-64ae0d66b27c;ns=0;ce=1;qjs=1;qv=7a1cba14-20221011131736;cm=;gdpr=0;ref=;d=bg3.co;dst=0;et=1665681648721;tzo=0;ogl=;ses=75430819-6ec6-4e41-8748-6d16a6224352

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.192 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 style.css
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/css/ Frame 2982 1013 B
779 B 207ms
204ms Stylesheet
text/css 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/css/style.css

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

99a897b1b6bf0d20afe286cd5e66a7281c3c8eeb69c9aa0dfd42175fc8290aee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:40 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"62bceeec-3f5"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:48 GMT

GET
H2 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2982 57 KB
23 KB 518ms
170ms Script
text/javascript 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 13 Oct 2022 17:20:49 GMT

GET
H2 200 image-3.jpg
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/ Frame 2982 15 KB
15 KB 175ms
175ms Image
image/jpeg 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/image-3.jpg

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

3e32821d9fb7d097ae2947687180f9d72e8d6587ca146961aff1e5c91cfe7957

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:49 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62bceef5-3b22"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 15138
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 image-2.jpg
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/ Frame 2982 20 KB
21 KB 170ms
170ms Image
image/jpeg 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/image-2.jpg

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

689d691bc0a94e08a5731d2e34dd06ea9b907d40c1ccca65e8f9a4feb4fa9742

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:51 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62bceef7-51a2"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 20898
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 image-1.jpg
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/ Frame 2982 10 KB
11 KB 231ms
230ms Image
image/jpeg 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/image-1.jpg

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

b7f8a33337b7fce3e7b3dd76d839d1e9bf3b83dc7c5c6fabdc44e2795459c2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:49 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62bceef5-29cf"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 10703
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 copy-2.png
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/ Frame 2982 2 KB
2 KB 271ms
270ms Image
image/png 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/copy-2.png

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

342d9207010dbb5769fc2988004bf46d4f579e8284fa3931374049e0dd55075f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62bceef3-88f"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 2191
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 copy-1.png
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/ Frame 2982 2 KB
2 KB 312ms
311ms Image
image/png 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/copy-1.png

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

360af8367592521fcd7ec8624cdef05e84e34d1c542c4a374828dfbe450da284

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62bceef4-768"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 1896
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 logo.png
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/ Frame 2982 2 KB
2 KB 322ms
321ms Image
image/png 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/logo.png

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

c0216a4ae9eb4d295edfee2917969c200cefbb28bedbbf8ead8f4a4609b82403

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62bceef4-809"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 2057
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 endframe.png
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/ Frame 2982 9 KB
10 KB 281ms
280ms Image
image/png 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/img/endframe.png

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

1904751ccfd62fb4368f0c10c93aa705878d726a2ecfe982877e838437735b0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:31:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62bceef3-25c7"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 9671
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 leos-display.js Show response
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/js/lib/ Frame 2982 2 KB
1 KB 170ms
170ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/js/lib/leos-display.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

2e8a854dbb9d8baf325f950347fa3b876ed124fd58546abdd1ce0c9e69b63d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 30 Jun 2022 00:32:30 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"62bcef1e-77a"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H2 200 animation.js Show response
static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/js/ Frame 2982 477 B
567 B 170ms
170ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/js/animation.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

76e1b353ad8b888eb77cf1b62b4fb4ee02ff5126f7ffc39c8c01582f93dc6e57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.criteo.net/html5/97390/20220630_newcustomeracquisition1/336x280/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
last-modified: Thu, 30 Jun 2022 00:31:40 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"62bceeec-1dd"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:49 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E7B1 13 KB
5 KB 171ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 220271
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Oct 2022 04:09:37 GMT
expires: Wed, 11 Oct 2023 04:09:37 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E71F 783 B
1 KB 519ms
174ms Document
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cd95f309a508b06d4aa6e2ef1591802695d22a308de8e97fcddf98208fb12937

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0yjXUZuXPfRlxHBT2RUAVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-0yjXUZuXPfRlxHBT2RUAVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:49 GMT
expires: Thu, 13 Oct 2022 17:20:49 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame B5A2 13 KB
5 KB 171ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 220271
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Oct 2022 04:09:37 GMT
expires: Wed, 11 Oct 2023 04:09:37 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame B7DF 783 B
739 B 478ms
175ms Document
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

db73b4ac1836fd9b4cc74c8d6ddb18e5a77ad14d7a08d9906128e5a06c48c6d2

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qNTJStaP6LgGo4pv-82apg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-qNTJStaP6LgGo4pv-82apg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:49 GMT
expires: Thu, 13 Oct 2022 17:20:49 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 216 KB
75 KB 473ms
172ms Script
application/javascript 74.125.24.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

484f66fd184a740cc535651154a5cea313885fe47a31093eacd3ead16df418d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76616
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 13 Oct 2022 17:20:49 GMT

POST
H2 204 log
aplogger.adpushup.com/ 0
53 B 400ms
220ms Ping
text/plain 104.211.156.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=linkPreview_failed_JSONRequest&data=eyJzaXRlSWQiOjQyNzUzLCJ1cmwiOiIvYS9mdS1oYW8teWktbWluLXJhbmctZGEtbHUtamluZy1qaS1iZW5nLWt1aS04Y2hlbmctd2FuZy15b3Utemh1LXpoYW5nLXNoZS14aWFuLmh0bWwiLCJ0aW1lIjoxNjY1NjgxNjQ4ODk1fQ==
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.211.156.162 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:48 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame E7B1 36 KB
16 KB 169ms
169ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215348
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame B5A2 36 KB
16 KB 169ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215348
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame E2DC 0
327 B 487ms
194ms Ping
image/gif 172.217.24.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~l97bugwb&c=745880136801479&e=31068458%2C31061691%2C31061693&ctx=1&met.9=1.os~2.1cv~9.0~3_1.1d8~7_1.0~4_1.1ix~5_1.1iy&met.3=74.1cx~947.1cx~43.1cx~947.1cx~6.1cx~91.1cy~947.1cy~95.1cy~77.1cx_1~724.1cz~894.1d0~808.1d8~808.1d8~112.1i9_1~646.1ix~800.1iy~800.1iy~800.1iy~800.1iy~800.1iy~801.1iy~825.1iy~801.1iy~355.1iy~825.1iy~647.1iz~965.1iz~94.1s6~947.1s8~573.1s8~598.1s8~113.1s7_2&met.10=1_1.IPINEAAIABj___________8BKAA&met.7=CBsQCMABy9_LwQY~CDsQChgBIGQoZDD3BjiUBmixA3CXBnj02gGAAcjYAYgBqvsEsAEBuAEDwAHizeqWCQ~CA4QChgBIP0GKP0GMNMNONcGaP4IcKoKeJCECIAB5IEIiAGK3xewAQG4AQPAAePRrc8B~CCgQChgBIOMNKOMNMJ4POLsBaOMNcJAPeJe7AYAB67gBiAHb9wOwAQG4AQPAAZvh-nA~CC8QBxgBIOYNKOYNMJIPOKwBaOcNcJIPeJADgAFkiAFrsAEBuAEDwAGb_4nHBw~CA8QDRgBIOwNKOwNMLkPOM0BaO0NcLgPeJcEgAHrAYgB7AOwAQG4AQPAAb_emusG~CC8QBxgBIOYNKOYNMMMRON4DaJMQcMIReJADgAFkiAFrsAEBuAEDwAGg2p_0CA~CBsQCDiGEsABy9_LwQY~CBsQBRgBIO4NKO4NMPwROI4EQO8NSPYNUPYNWMwQYKAPaMwQcPsReNAagAGkGIgBzi-wAQG4AQPAAfW11MsB~CBwQBhgBIIkSKIkSMLQTOKwBaIkScLQTeKwCsAEBuAEDwAGUhOK1Dg~CCcQDRgBIIYSKIYSMI4VOIkDUIYSWLUTYIYSaLUTcOkUeNpZgAGuV4gB_XKwAQG4AQPAAfPyy64L~CCcQChgBIKoVKKoVMPIYOMgDwAHiwZvaBQ~CCcQBRgBIPQYKPQYMLMaOL8BwAGZlZ-gCw&met.1=1.l97bufe2~6.0~7.0~8.0~9.0~10.0~12.1~13.2l~14.2l~15.2n~16.2t~17.2t~18.2t~19.1s5~20.1s5~21.1s6&qqid.1=CIzkpNfb3foCFXTNcwEdvwMKzQ
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.24.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: hkg07s23-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
fonts.gstatic.com/s/karla/v23/ Frame 3B84 21 KB
21 KB 514ms
171ms Font
font/woff2 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/karla/v23/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Karla:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8c2240958cb1fff47d921ca0f3097f9e7403ada01af2382477ef42c404c38d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.as.criteo.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 10:37:05 GMT
x-content-type-options: nosniff
age: 24224
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21248
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 20:38:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Oct 2023 10:37:05 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame 1BE9 0
127 B 172ms
172ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 13 Oct 2022 17:20:48 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E7B1 0
10 B 170ms
169ms Image
text/plain 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?ygO0Dw
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 11BD 42 B
64 B 175ms
174ms Fetch
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss4kAJfoJn3AHgfZeHQdQ6Kl-ItaGOBd3OABpe3cM8kY497wHqp2uEFmdLSBTixF3h_Kl-pof7L-jE7wSi0BtqeWGI8&sig=Cg0ArKJSzK_dqRUsVcHIEAE&id=lidar2&mcvt=1013&p=0,0,280,336&mtos=1013,1013,1013,1013,1013&tos=1013,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2365071409&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665681646957&rpt=1328&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame B5A2 0
10 B 170ms
169ms Image
text/plain 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?oZl20Q
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E71F 0
0 169ms
169ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022100602&jk=159797973247066&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B7DF 0
0 170ms
169ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022100602&jk=745880136801479&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
122 B 172ms
172ms Script
application/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 172ms
172ms Script
application/javascript 142.251.10.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 67 KB
26 KB 568ms
568ms XHR
text/plain 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1973977989840561&correlator=129754508371649&eid=31070347%2C44768257&output=ldjh&gdfp_req=1&vrg=2022100602&ptt=17&impl=fifs&iu_parts=103512698%3A22574853003%2C22477626096%2C22479095528%2C22579309510&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x50%7C728x250%7C728x90%7C690x90%7C690x250%7C675x90%7C675x250%7C670x90%7C670x250%7C650x90%7C650x250%7C650x150%7C630x90%7C630x250%7C602x100%7C600x90%7C600x250%7C580x90%7C570x90%7C550x150%7C468x60%7C320x50%7C320x100%7C300x50%7C300x100%7C300x75%7C300x250%7C250x250%7C200x200%2C320x50%7C728x90%7C690x90%7C675x90%7C670x90%7C650x90%7C630x90%7C600x90%7C580x90%7C570x90%7C468x60%7C320x50%7C300x50%7C300x75%2C320x50%7C120x600&fluid=height%2Cheight%2Cheight&ifi=1&adks=1420297610%2C2857874404%2C4082231052&sfv=1-0-38&fsapi=false&prev_scp=adpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.00%26hb_ap_adid%3D74684f7f843a5e9%26hb_ap_bidder%3Dappnexus%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.00%26hb_ap_adid%3D755b2fa0d31ea85%26hb_ap_bidder%3Dappnexus%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.00%26hb_ap_adid%3D76c746f5e84c663%26hb_ap_bidder%3Dappnexus&eri=1&cust_params=da%3Dadx%26outbrain%3Dtrue&sc=1&cookie=ID%3Dce5ab772cdfcb848-2241a1c0f9d6001e%3AT%3D1665681647%3ART%3D1665681647%3AS%3DALNI_MbKxf0CZfZlEnaXL9fNU3Lu_Kk8ag&gpic=UID%3D00000b60a09ea44a%3AT%3D1665681647%3ART%3D1665681647%3AS%3DALNI_MZFzrROHR2znJDnPgVTwHO6Y2King&arp=1&abxe=1&dt=1665681649604&lmt=1665681649&dlt=1665681643714&idt=3882&adxs=236%2C436%2C5&adys=60%2C1110%2C300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&frm=20&vis=1&psz=728x-1%7C728x-1%7C120x-1&msz=728x-1%7C728x-1%7C120x-1&fws=4%2C516%2C516&ohw=728%2C1600%2C1600&ga_vid=2069385963.1665681650&ga_sid=1665681650&ga_hid=9989&ga_fc=false&ga_cid=amp-UBC05d4z3uBSF4l475Zznw

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e3a7a2da26334b3c117ae0d0cb6ffaf61c276e515712d1a0ae172de6eb75dec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26628
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame EAA9 6 KB
3 KB 178ms
171ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:49 GMT
expires: Fri, 13 Oct 2023 17:20:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame CDF2 14 KB
11 KB 179ms
179ms XHR
application/json 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221011&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7408baa6cf62191bf64bd18e9397a1ba69a3262e9737b1ae26b0b1bc6f38cf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11171
x-xss-protection: 0

POST
H2 204 collect
www.google-analytics.com/g/ 0
106 B 470ms
167ms Ping
text/plain 172.217.194.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Z0TZ7TDHS1&gtm=2oeaa0&_p=9989&cid=2069385963.1665681650&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1665681649&sct=1&seg=0&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&dt=%E5%AF%8C%E8%B1%AA%E7%A7%BB%E6%B0%91%E8%AE%93%E5%A4%A7%E9%99%B8%E7%B6%93%E6%BF%9F%E5%B4%A9%E6%BD%B0%EF%BC%9F%E3%80%808%E6%88%90%E7%B6%B2%E5%8F%8B%E4%B8%BB%E5%BC%B5%E8%A8%AD%E9%99%90%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&en=link_preview&_fv=1&_ss=1&_ee=1&epn.value=1&epn.siteid=42753&ep.error_msg=no_mapping_success
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.194.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f139.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:50 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 38ED 14 KB
11 KB 189ms
188ms XHR
application/json 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221012&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/show_ads_impl_fy2021.js?bust=31070320

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b516b282f807b955e3ab780d78d483439c8308ea1881eb205b8798cfb9be8912

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11264
x-xss-protection: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 428ms
167ms Image
image/gif 172.217.194.139
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=a1&ds=AMP&aip&_s=2&dt=%E5%AF%8C%E8%B1%AA%E7%A7%BB%E6%B0%91%E8%AE%93%E5%A4%A7%E9%99%B8%E7%B6%93%E6%BF%9F%E5%B4%A9%E6%BD%B0%EF%BC%9F%E3%80%808%E6%88%90%E7%B6%B2%E5%8F%8B%E4%B8%BB%E5%BC%B5%E8%A8%AD%E9%99%90%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&sr=1600x1200&cid=amp-UBC05d4z3uBSF4l475Zznw&tid=UA-172083736-2&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&dr=&sd=24&ul=en-us&de=UTF-8&jid=&plt=7375&dns=4&tcp=406&rrt=0&srt=869&pdt=2&clt=1323&dit=1323&a=9989&z=0.04813259410870052&gtm=2pu000&t=timing

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 01:24:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 57390
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 187ms
187ms XHR
application/json 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022100602&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84a1b18b0817e7c702a35b4a81db1dd013442c2532402ea574dbee0e2ad2d8a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11331
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 17BE 0
0 172ms
172ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022100602&jk=159797973247066&bg=!nZ6lntrNAAYqRg79CkY7ACkAdvg8WifIhXMaojlQcpmAGCbNinyrABiPtTxYDEBmcJIKVcFbiem3UwIAAAB-UgAAAAJoAQcKAB9PMlzLnjljRscXp33ZqTpE3mE5-k3bV5UvIXDjFzpXmQK9M4hIgzlCxOVe8jhNNBpqkKmEYq1B7MntEHgF7yIIyfxGhdEiaXRyhUl2umtG3RpQVsJ6Nl0_en9_j7-BlsZH26shAatml9nUZnxMd1aVbtz8fp7xb5tGeljjXo-XMfsuEnQRw-MNPgRznm5iLtv6uiO4jef6i_V3eEl2AeC-yCY9mXSJpRThAtpDxcPx2lrKoEa5UnMXYaXSwTj7LpsRWa_CAAiq-eGwsBvGydrvC2RM3qGj7Uo5WqGXdCsmy10DD7l52AmsYQfpSAJf2TbqFG-RulWqgnZr7-2MwLkry1tPfxNvam6UhdUjNOGJoWOw-iVGXeDY90M8tjApb-coN6WEELEweUpkkUtsZDa1bYxUopuKkJEd9cpwUbJbEweoy4hbS-2RWYzbFFFGK0HzCtOxwrkamCE985m4-Y2HW-bKy9WFYLiaMWkvHTt4je9TKklIy2bJafCcwHAzvrJYLzj0W3XrH_yHSb_OBgU_I_1nZcQDymnHUCbCScjbqK1RUVjT-tl3WzLBwG6x8_uZMkHqJKs11E-Qy5vIeEiyQFMTbnhmLyztgB07VPYRASkEF-E0v5_wbLYWvZgyUmBHXk1GFg9DPnZKJ4uJ2edGQGaJ-41WfjS0jDcA80z0lpAnheojrySh88jqHWDnbTv2cOPwFAub6rE_qlwzhirwY1V7sF7uRf6UeKoSlm8CkFbcPAJBrt1X9N5MO7KSCOxcOLkfyw6z05LziUDhd6cgHuPhNi_r3SaFsw5muA-1BhatHuB0_H3VLhExHjaalZyzg2iqe4ptlDwir5TQxn2Km5fGTFUTLy9hF2GvAvaZTrfB3HnvbTwot8h3Bhw-DT25NGxSHQ31iWJJvCjJtJhB29o5xpUpF5SVzWKeQfun5aVfXT_GHGVvQshjn3gWjM_QAlb6ovSGBoBGVvf4nxI
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame CDF2 17 KB
6 KB 171ms
171ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210040101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:49 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E2DC 0
0 172ms
172ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022100602&jk=745880136801479&bg=!VValVhLNAAYqRg79CkY7ACkAdvg8Wm4M4O7gxI2VnuRzAvOk12fJevyIi_3vxrNy5p4PR-v4f2UWAQIAAAB3UgAAAAFoAQeZArHvJ3Pyb2j6hZHQjusbiNMgp097SzQcEUni7fuX0yZW0Xq2gEbxN0puHlKgGaSwcV4UgIqCRtqnpSxbf9H8cD1ezaPT-AVcdVNjardOjk-LXNxjvJcrrBWSmokJ69HWDSmPJGUZyg5Q3sbatON_tkUjvqxz_ClnnMegoPdbU-p8byS6_nc6YjM1JyaGQRMCKdCKOMVh5hZtymIUG7z4PGY2xJKgI8QJr2TODr7aB5S0OOX5_1dKqnsELEU15uTH_Js5cNfKr5ooSJaNnaUOdVOrVpiD2OHRHeXLQ7kp22kEAISnN9EiZoR_0z-mcM0kot1X7IVSbsPUfi7QXexPk5PqjuXX5DrWHS9eRZjcLMjW-BRu_DdAvoOeSIEGKJyuXW7KjWK9iVuSOycGlomT26elHRD9WP_9s_aACfBHj0s4_IJS4IkL6OsvH8y8954DsaFiAWs4MVE417-fYFbLhUd_Dml-KchoVXEGjikBSExpmOnyoSfxvlOgOkarg-o2P8Hk8w0Qiej_FPXb1TjB4j2yvJ2vfplofipHjyXiroLI2rWQ_PJbZwAjlv_Pj3ucnGT3c9OtpOvFrbhYkjTDyx1TiSHAYmUKYpRtQdQmnf9kcAHFenW5G7kMCH-zQ609HU8KdCAVy1HyN56zRsSxZ6NfleWXJuZwYCLQ-LYvGH_0PZt3nxKXkMkMA5YTii86azJAgl2LQakXhl7vDmuM8xS1VfUezaw3LwilP_tCSHCNQIj4cVRm3lmnk19Alv7bTWjBqBjrhFpWpxnuZq5yaJk99MCuQvsrRYETkC9pLexXkzKIeT9wdr0JQD23I-JfDFRVvrIgHGvh2wsxIXp1py9SDFXj6OP0qwIc0UZEc1AMUZq73Hm3pG5nqhzloI7MZ0ZHLksKLdPA928oXhvnVE6gXg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 38ED 17 KB
6 KB 171ms
171ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202210120101/show_ads_impl_fy2021.js?bust=31070320

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:50 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame A14C 13 KB
5 KB 172ms
169ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 220273
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Oct 2022 04:09:37 GMT
expires: Wed, 11 Oct 2023 04:09:37 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0880 783 B
765 B 477ms
174ms Document
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

07695ed14757f28e439d505a5736a17c0a41fbcdcef94e066bef801683b2be42

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hXE_M3qoWkx6wNTPw5Tgng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-hXE_M3qoWkx6wNTPw5Tgng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:50 GMT
expires: Thu, 13 Oct 2022 17:20:50 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 184ms
183ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:50 GMT

GET
H2 200 container.html Show response
478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5F45 6 KB
3 KB 471ms
170ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:49 GMT
expires: Fri, 13 Oct 2023 17:20:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1C44 6 KB
3 KB 471ms
170ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:49 GMT
expires: Fri, 13 Oct 2023 17:20:49 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6A4F 6 KB
3 KB 478ms
176ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022100602.js?cb=31070347

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:50 GMT
expires: Fri, 13 Oct 2023 17:20:50 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame FEBE 13 KB
5 KB 171ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 220273
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Oct 2022 04:09:37 GMT
expires: Wed, 11 Oct 2023 04:09:37 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 12DE 783 B
534 B 334ms
177ms Document
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

18b7cc7509f3a7218d922dc128789f228705287a3499fd39c80886b8cac56665

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KtUw-HE1jpDE_yhCNXfb2w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-KtUw-HE1jpDE_yhCNXfb2w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:50 GMT
expires: Thu, 13 Oct 2022 17:20:50 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame A14C 36 KB
16 KB 168ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215349
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 42A4 13 KB
5 KB 170ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 220273
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Oct 2022 04:09:37 GMT
expires: Wed, 11 Oct 2023 04:09:37 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 319C 783 B
536 B 305ms
174ms Document
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

86709786a7a217a7d512b619873934ef16cf5d5729880432f61313441b251190

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-aeT6qSNIS9V112JXXLASHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-aeT6qSNIS9V112JXXLASHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:50 GMT
expires: Thu, 13 Oct 2022 17:20:50 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame FEBE 36 KB
16 KB 169ms
169ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215349
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame 42A4 36 KB
16 KB 168ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215349
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame A14C 0
10 B 170ms
169ms Image
text/plain 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?2quX7A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0880 0
0 170ms
170ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221011&jk=1075327899981005&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 319C 0
0 170ms
170ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022100602&jk=1973977989840561&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 12DE 0
0 174ms
173ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221012&jk=4393964291990564&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4D8A 624 B
297 B 178ms
177ms Document
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axj0kqjUATAB&v=APEucNUj1NorSgkF5SJtNPQ1TNWJKzHxI0p2tOBOHb2EfcUjTw-Yf42O41Lry5Z43EmaNz6uISmnBZErIxcUCFI9sGhJxD4Zgg

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5F45 15 KB
11 KB 204ms
203ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CRaMrIBql2whqkfuSIl6XIHdDCiDM4MgnAmD0T9OCMf7RkluzfEbOGkHfEfYniZKc-c0Vk8QO78RWGPnEegs4rbDsErMoLF1bJddG46tWNDh6z3pc0pRy-DbTg6NFmPXakbKXWM80aae7Hx_iZ2ZnxNvsHSyN4lAwMKzJ_PQAFcWp2Vgw&cry=1&dbm_d=AKAmf-CZ-0CjDpFBSqHHIxOTp_jJub7HiqV1FUlLShOrHtIcPopEd0hvghqyan5OrH7iCPvU1HxU3yOLvNkqRWQ6Q_ms1eHPMoRnfsYqUx5RiTeDEMoxFM4pvSiRylVO4H6FCehERQQt13UOVxWeEu0s0bnE3kESf3HwmCxJClFr0VafkZ04gTVdztCddWw31fwGRwSOn3JTF9GFh14o5Cl4OKDBQhNO3F26OTW_oWXqjNwdcVl8cbPNVJcAmBc7Op20atltzVBfd95csLli1cVwIZZhVGOmPUwK9DnnJVvulR7qVTLzJg6vBMVHhySU2iZr6A-NvBAOzEaeVAdF-x5TwO2puAtSDiPiwVhOyuefwkfJd49AW_sRhTwFPaEoNNFXMTPF37EO0Wq51vxXCMxPLIRJtDsQWAjlsMD9yYmT7FDlIPdBc8Epu6Ow9oMZN9pn54Kn60f09nVl29Qb7obEFbTMMg-DAqo11hEPOgJxkywWF1Jd494ECoHMtjoydSUTyHNa-j9pbWM0I9PJq820YPxH9rZOX6Fp_bZWWALs58pEHa_6d-dm7u2z04XuPU3bJRTxWCtHPZ-sMt37Q_BZXxVvXzGC-U85x1Hvl0QKXdu-gQHjjF0hVJOOKBQ2Itcj-Yi7jV2PZD2g1NVW-1QhltMxKZVzVFamyKCjpvrr7sf5CY6Lb-Ss7GJoUMFZFpBsB8q3KT7WPGfsZ23nm_fLDF5EDIeIReObOZKGNL-ysf-KTTzUUkKNxE3JyLvwyw-wX7CEbl5DjyBYcOmLh6RyLwF17w6-YC9_Gt1voibpq75SKuDtWS8rENF7BHS0sgVigL4XrIG3RmA1g_7at1MJxRd1-P3hGSMeq-SRdDZa9YAP_kr_CH-3y0skAgQ6LlyoGhxix_AhoWqsJWNPoIV5SMbdxEzmUlF8O8vDFOqSCbFUS1RNmV0hpIJDw7Pj9BrTNC3wFHMKHfy5Hwo_MxbmVmNJ-WMBrwP_El5ruBJ2wZn-MZCXiMQHCGLU7_0UBf8CW8Issp2J8Gf8YVB9Im92Gc2p94b2OG1abWtCjaHD3fUwMCLxOzW852segD3hh4fWRoIcwWuDXocy2FoaJTFk2z8hajiRLv_g5h8oxyUTAeGwHzDoXvoMYw3zbbiLCbcU7m_Uh3hmncCU8PqfOevun4Z-jqMsJOX7yzfkt9-tUry7dlYAZ9XzrcXIHxGIEXxlyem_2QLXHxL_EEQiFtrWo5hQVvAqxv6UZTyWrPt879vIRsQIHhzLM52vdNzob0NYz66jEDmC-QnCJfAW6iE55ka469gx0_enZr0B-YW-xrGx1RUkJlKalgzeFM7hnb9-iDUvntaOI8tlc1zh3zOCbBQT33aLIS4sKBpNMfRXze7Ptl6Att2GHrja0HsGdPjD7Jv7uBKXKap7Ve3HwzpUALjXptjiKimSiyp-EyIkSFSKWhA0M4Hb73vU3lEbp41jUvEjOUJsKHB9MWCmK58Vv1On-EZ5mBxfq-ZSd7JK8oFu5Fm1LhxNCLXDjdYRKoNlGz43avBpdPMTmbcCpaIzt4wIPGrNStixHu3D58QYsKQyzReJYWNzecjkKdzjoBjnQf_8jhcxwvZvSyt09o9Sq9Eow27-9xoRBpov5yIVi6gCuC1U17JH44tWbjrFDxRS_mmf5iXqsa1CTSMq-BKmYezCYBQ2fDAQ8oGrnc1eHnHQb0FCukfX1Mk66Eod6IFQOUyEYo6K3CfhpeytLYvw-CxWyGbou9GttqaP79ogcKMPfjL0e5_MGufaSB4DagiIxWoClDQGISYAZPxhEJpEcycJhJGlWcDOyCULtTWppSHLcMXY5OPFfwnEjGsLgumcEGEM9nk2tE5cvWGK6MGCAuivPP9UVVJWzRTeY_hCle3EXi6uUP1R5GM2gw9Yo3ImKDoHJytCCdstc2PdLTvv0E754z2eFfRtAqLhcJ5U1IYWTVMTGDVyD78gKv6BBLrkB_rha00aiVf8uqp79Fun7it8t2w3pYPXogmXItraOFy2jaEBqsbbpUGaIKvbjS-IEZLzfwbAOoYoqtUMLRxeHtoXf0bw7hV4jmmx4pP3cFL2FiUOM8hFRcIzShcbULTkIqfnK4L6LegpUtRYqr5efm1qxDSYu19ovYiZWX46-cMbLfeQJLHNNKuF2j0x8KXIZQiy8oJLAH78iCi3Eh0R41Ly0F3q098AiurXZ-cbxGK6dT04zatlD2K7x9aeq0K2gaTNnSULGGKDeEjXKzd9J5gWQWnOztdM6MqoGC8Qa3qZUAqL44sUFYvc2Sf50DGeiJEwupcITuuEosV5nNHCs-SeTMejOlbPJFLqZfFrdgqRy18xSBt8yjvCs_ue_ZWfLzwYrPldK9zEZn0_ShwGLdYEuqJ3GMZMaCUDpTr2xxhaQPZBTbeoieCc0u3IRqPB0upakV2K6FHd-SxoM-qEC214PL0igiNFDFvGE8Fnvkico7RKZfnmMbv0ADfCkPR5Vkryo_RDlTKAcqMdhMndhAuiv6S3juafiL7eHk46tw8rBhR3g9HAbT-Rd3a_66jPkCHD2GjMuRgk2IbYvyRyH-DYet1OD0v5gHiNOFKQfcYD6s64Xz3_vciuH3_4ufnYp6EcP4946J5Rn34lAfNyGOSRH_nBhL0KDuLdiNqu50F04IyKlh3-oJUaE2pBPRkYE553Z3Fkyc1QLbGzweNa8MjV60uewWgpu4de1U46m-oGLOpvC3dyScvgk_ALq2pBbhdP3EXTYBJtxAYDiudyzwZfYLLFeIyVuR0dSp3sX9gFvWuKcj76PmtNXn2ZCKraqPKr6Zri1oyt9ALekDDH1bsrxshj0RLtFtRti-VgyHx9oW1r-J2k3oxJzJP-MJ37XFY9XRycWaN8HBtuO_ZlYQJtpfncYT7tUcvus3LpzdoQ6giTFQOCaiuQoxIHoGzcE_Y9WzWS76AGYYmtbgPUXpYoEqQZ-N2dNfbMpIcPNPXjh1MHhvMLHcAWcdR8LKwV9j_0c3bib3vTc7uAf0lR3cKBTsRcnwgSK6lXXlbmF6M6-Ei8r7s7V0fNLr5zNkTl3L4k_iEFtgj1VdV3CVIpH8Z25vbOJu_ymHptBDZ5n0TZ2guYBmfo44Adue0WD3YB6ZwandukcSXxQvdJi6YFrb5fgPW0iN5svPZo_1gFLFAK2o527WmGudiOohOpfYi1VPuMq5OyVKcWNrWsCrAKdShlan9QA--P5CxTGgts6DwDf01DhbbBbhnhfVKKdpjLBBRCejMfCxSv8khbdAtiuR2acFYXlQ&cid=CAASJeRoZqdY8NualZ4IFFxajYcnzvtrbSnLv5ag-nqLdBTXPg3wPDU&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c83f5d24e033554feb95c8927ea2d77057c289b9fb7985b71b73d65e66c792ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11331
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5F45 42 B
63 B 171ms
171ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DnEdwgYbLiPLZ90iJKUzyHoxiZFecDHpvn-PX4Mc6ZNJIHwCrUfvjzra--C6Mwz5LDgwn6xP1cWKR1xXJH057hg-xBuHgL7JJ2hczdi84lbBaevmk

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcmads.js Show response
fw.adsafeprotected.com/rjss/www.googletagservices.com/1193990/66063503/dcm/ Frame 5F45 236 KB
70 KB 705ms
172ms Script
application/javascript 54.254.146.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/www.googletagservices.com/1193990/66063503/dcm/dcmads.js
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.146.150 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-146-150.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 40e0d019c5f33b865310e150c15cbe1d8725eab0cb0c4dfc853c2f12d76afd42

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame 5F45 47 KB
13 KB 705ms
173ms Script
application/javascript 52.221.37.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=10933&advId=1008917700&campId=18563143810&pubId=1&chanId=881479034793&placementId=445254004&dealId=&adsafe_par&impId=ABAjH0ivbhIJmEdEtPQSupELnbYe&bidurl=https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.221.37.40 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-221-37-40.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: ba7fc37ef6210647aed8140f82d0b8ba78703ed58b9758c9e78e910120ac8087

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 5F45 3 KB
1 KB 172ms
170ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/window_focus_fy2021.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 08:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30970
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 08:44:40 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 5F45 17 KB
7 KB 173ms
172ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47099
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 04:15:51 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5F45 0
0 218ms
217ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQctCc-Kr4sfGPkVww4nvFYy3y3NYgFReBmIm1tjYUypvbH-G7jZLufZrIAcdQD771UnAIndsLrrJkxXuP5kZMk7oFOlw
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5F45 152 KB
46 KB 172ms
171ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:50 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 753A 624 B
297 B 176ms
175ms Document
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axi8iajUATAB&v=APEucNVWb2wW8mBSlZ-zPeZpla9ql4QyKKjLG-AnLunSXmtInw99x9ftgNnx3u4cL9PLlBkvZAnW5Gq7XmtcVjYzxNtfbfncQA

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1C44 15 KB
11 KB 201ms
199ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ckvfa0zSX66tXUECXzFI2N0GszFPewa-efsSYHZ3-KCLRoTgXQkDm619400PY4mgbqnQss5j2OigHhToWlVN2DFyBtnwiNULdMtd2uLIIjdZFxF5HB9TskX-6EzctPoKQDx4aQExRZ02wZSrTuVFaeVHyoOgxRHLD5HPldnVf2yHuuVAM&cry=1&dbm_d=AKAmf-BVLqQ3jEe9mMud4B7gNjatz5C0s3aKOae_E3KNNxkvXSIikOkkPgQ8C8XUz_e1O2vgFQ62dezed3u-9AjWz0zL-Goczzk11MicGOXiBX8PDKTVR5pA_ZKFaOYHQ1auMJSecGG2qyVZZX8-EHWIPNR8gDxee95elbG2Z0n6d1d2QO5ontojZLAtmuu2oSDOgz7vXJNneDvGFQDQRiii9CGUoqpcejFa8PMYoR3L6OR0JgaUDOsR52NgJ6sUkS3DEP5zh2sR7mJvgOAm_kZ7DnISwLopZjII5yiGng-ZCzb-JcP_GBoKxu18kG8XLumu1Am8EALQmOwsv_JQptB1DuQYXP9qsiTW6SwN2sBRHSTcXLNp3p9hVhMZyo5mRQKZzMFuwm4OX3_myk3jptEsMU8oILcfo_OtMqmae5xhgaCqd4x_fDdpS3l5Zt3sGtQO9eJnokfghn5x6uHjyOeqROd7kjVZi7PxXrh-7LJnDyDeRC931fkegwUY8nssMCJ10dXq9Dev12VrkvPqiFfNiYoLL8D5V3xD8QEPhKdTs7NP2JXM-nFHvAL7rm1-u1h3mpzfbZz1Ym0tyuqmNlHQp_geQlpD8xIQWrc0rEOI44bGGt61Fu2bBuj_rvwOVWiqeyntOu5aVhp8M9IvOgsChO0N8AdLarYUhFL3g-xRSYn46_CB9EGlbG2_JCpxuTMNpWYWcjpO_JqjyZ4nTSq7HMthgohzCVgnlBrf_RHOZIs0Z0k7YP368viSrnpXi17FCzMehXsoR0Sj8pTfi_OWtXSvhO4kMzuT0_Zcp08PD1K6yyFCytW4DQUpjLO4AFd0GSE33zINtbjj5CGzn3nR4qEyX5RMK6jnYVH0d3XIzYhL06jNTCqlWa5Xi2ARQbi3rZQOqu2ffuw2Sj4x-jGrqdvqLQ-hIkWopM8Lq40Rkgzs9GNFF0HUqySxSUDdPot42EAqTt-XOFwnuv-82OO0kZvZMf8VZ8Jo3yivOb_ScwrUW24LWld07tbI-idrv2l3lN6-Zt0iczCLUmJmmPyDv0CvpU-UCyW92c8gTU2el9ps7ugy6CyOjkwgARJ_vhhRsPiAjPT2PzrrgKdtYImXLMhk80nOtcJ2gYwj8ZuVgS7sQ7EgYoghkyIDIYHrC4Cc_emxM2g4IB4qltV809si3h20b4QZhE5Anz6voUSELW0uqedgjRYMiFgVkd2mCW_NvGwWnTO3BQmEs0Wl2EKFBLrHziiDbY4zUbQwff8pWFQRwVFIU6AwNfTxbe2j0U4FdihfZUNB02fWBHyzSBuJDhVugsXbFZX928n7uWUCwa7zVkJ0KHMCktMjgnHVRK61Fu9N-RBnnZz4amYacuJHu6bF0vgPihAbjBJaadrbucppcoHRwkuaPaFnNAPHP7fEN0TPVF1XI6xsXhAie7hXsmjEc7tfDvYsfbwMrCVt8j2k59mHH3zm2RYHjIHDmTFwwPl8o4YVVCfvMpso0C7MTkO3vaF8h3gAKQfFsHkYqg1A9KxxZwYBsLCkGkW6zy6RPtVsktJaugF1I-Er0Fxtp2eQAcD9Vd7AuhI3xONZvzgCQ_wMS7RS_5KDy40tLyZcWi2MdGDKVLca6GRDr4qJr5-mjbQxLG5VfyQeSlDRLvQ4OfH-ThsZkP8O0syyAWAJkBkQfp97NhbUpxJ3jMxjIuJySFT90cEgeGeZO80pwk8wmhMHHk5CRApLVmpm9D1kVUD74LQ3-eJVYqz3TTIr_ICqJiA9el5HpQ3wTWzE6ajnuuZyOrvH72r2JzH5_lEK0YPfP0ODECGy2msbtm0Rl_t0DRObc5hgcyAbUDMVFalRGrKW0VQTXwH9xT85J1TeXjl8V3WYWSCfWP4T2nzARG5wcm3T-y2S8qB_cfsoiafafz0pzciacPkwBqUnyeRfR1PrTyNYP3vgKxjXN0ejUhpR9CU2p90RPEuByktoldEs3aGpJ2OqX-zKPhUqFIbfckjtTgwuB6WeKHQk2kzDGEaFjvwCq_38FV32WQngBrq76FFfYtFlmwk1__A6E2TvYe20KbUDPvdKdRF7MIcAOmdOrwvzkD1GVx4c8z3Zda8aVWTxApZhCOaRLd6Z8gRbj7XcSKSLgAACcACN2FX9uiNvOoKWQQtegjHsiJrIIYFKwwdZpbcyZYNreVL_9N-w8o-xGzqpJV1K5geWo539xSZ4znrcQuQ9_bSDhXTnjXm2RFxCBQ99mLz9KGVYecgP-H5QcFT0Ehou5cfh21FKDdnZW12j-EmssbkDssN5psZxmHh3ywDgTleg53FAz_PrFlb3Rl8asaRyfcenz0YFcZMG6zB-E07wxUc7oVOLcrRmNFSCq2QwfkzcU7LEi9gcooo8xoAyOstdTE8CzZcovnjz86f01-DfoOYp_egy3RKa2YYS8YdI2VOY5HGDH6aaeKSZcGPjeSpsXR1eKew7BXtOCk4noNG-MMYum3afVHovJJ8KfZ5Q2Ff5j-eJBaMUga1RW2B86XDtt73bljvJN9PL8bne3HOonggNQk9EF7Hyj8eKfYB6EXFLhpJEp719Q9hSDGYvYSnBJNrmL5sg6eJqKAWNq9ETmAGc6jVe9ROThlpVw-gEqL2UD3axQZsN3UE19EFZnGPFo6TJ0HQsjo2KAdvWWPSrNVuqT2jJyqS0vNLsgjoTa7gE2fdQn7P8_rSq6dZL187n0cUQnNI_3JuIUfFZXhcnIEY8mOrsxog1rZ9Qp2eTbIDudcpb_1y_B60EjJ_uw9thHhpm8FhUVRVRjvySHIGZ7FA0_BLpX2GycZSGpDg_nq_y9MwCCiMTjE8fSPA5pk3-3gZUDGTn1nPI4bYwCh2DTpH-386sFdlzax1HcUxiDEFgHlIvaSzXpEh3XgFuAuGI2phoofFuMCvdTLPeCUu1074l1HZLQ4K3AoB5cjczumbxbRCDUDhenVm_pjbZrXPT8RlIRvrFB_606sKmJGYG0-kMS5k4gK6pbwplqmkC0ALKPaEaONyAG3AS2J0fcFYHBr4ZHzlk8d2ST7x-hAwVEJ5xB-lwIK90MiWXz2GAIsq1OiDWUXarYl5z2r1DUVVLnwFC4CM3p7cgqoMWAmGW7DvMf4TFRV7N3TSVx40BO2hVF3cY8ZwvCSeO27DAaH_YDbzs671to0lMU_Bo_p5zOqIc4EL5jgikk7R-ANfQXUexWE21Act6rNWdCNWK_H9_d1splJiImC1m0gnjGfz-zZNUEEosLYju9ix6GzIRdLKDMf-owRyO8pd2Z7i_6PYh5RAvD_og0RIZBEz_svQKrNtGuzwnwr3bdWkWPfs&cid=CAASJeRoPhpJ0uc6emOpZYOCHjqRiuSqRD10mNdd4XJRxq7dNfi7Wgo&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae1270919a9d33f3557f0840fca7e79ef651202cefc44274a503f220d7dd2d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11154
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C44 42 B
63 B 176ms
171ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AgGi_vcL7ANyMnG2vC6I3n_J-KhbKxB-n5kUGFZRJNhliNo0CxC2iqN3NgUqFJ5nFeJE3rh08wv0QK3GOHTCNk-8WFmMWEwsrYN_fqu5uXOB9DDcw

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcmads.js Show response
fw.adsafeprotected.com/rjss/www.googletagservices.com/1193990/66063505/dcm/ Frame 1C44 236 KB
70 KB 679ms
172ms Script
application/javascript 54.254.146.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/www.googletagservices.com/1193990/66063505/dcm/dcmads.js
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.146.150 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-146-150.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 23c1a9a7157f28a70a37199f464b94a09f67ae6fe872b6a61a92fc42cfdbbe2e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame 1C44 47 KB
13 KB 680ms
173ms Script
application/javascript 52.221.37.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=10933&advId=1008917700&campId=18563143810&pubId=1&chanId=881479034793&placementId=445252796&dealId=&adsafe_par&impId=ABAjH0igJ7x1lTujPDYebt31MnHw&bidurl=https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.221.37.40 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-221-37-40.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: c2d978fa43b16c84dca0913c7244fc861d052446a9374d5c9c850057d73de590

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 1C44 3 KB
1 KB 175ms
170ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/window_focus_fy2021.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 08:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30970
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 08:44:40 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 1C44 17 KB
7 KB 179ms
174ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47099
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 04:15:51 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 1C44 0
0 219ms
215ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQgaaWzWhX4o21cjIhjpfQg8D1TZjC_3F5rtRGdsrZgGHM_3BBYvkHdZNk3a_QO9h3TSgZ_VG823HddClSmo29dC38x8w
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1C44 152 KB
46 KB 175ms
171ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:50 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6A4F 0
0 184ms
183ms Fetch
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CR4gx8UhIY_PjLZCKvwTThr2oCpj80bFcqoTM5IUBwI23ARABIABgpcCjgKQBggEXY2EtcHViLTg5MzMzMjk5OTkzOTExMDTIAQmpAoZvK5eDHKU-4AIAqAMBqgSdAk_QlkzLbbuPeae9xHie0ryWAQaNqX_yYqEOyF7iEM4Es7IQ75K3VKwU72hWaRJJOlG9JJyTfxPqJMIvMeMJTabfiSBHPimwwQfcJRkuAxARd_cnTqBuee1YIFwobqZJPRwZfYX6yYgfLDyteSMUGXDMMlx_3hv7Mta4CeIbZ6mkmy1LnUKY8scxUECMBeG5o9BghRGbt_dEwxShjcssi8dO1QLZfx3vIAMDPZvSONe13dj0C7av9h8D-MCtZ2tYaxeuEicCMargZAG4Wrm56o3ldGAjlDOIBohzOVGchFVtYKlDFmFxin8sfJ83Zn9Eqf6qqguQTovKm-fQW9M4votAdxWRns0EPr3YVCREFdL1QX7sN00Px_NymW6RUOAEAYAG0KWJuoG40cz8AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgwgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTg5MzMzMjk5OTkzOTExMDQYyqse&sigh=2r4GdltLeJc&uach_m=[UACH]&cid=CAQSPADq26N9D-OArLL2Di_G8itSSng2oKojkVH2XIhn_smrV56DW-92blsc5Au1ri8iJrTp3-95Uf0v1JjgExgBIBM
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f155.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 6A4F 0
0 285ms
284ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=kJ2eFM7xBnjYBGL4LRICAAAA-ONZtFtuTcMQ8EhIYy95zR77DY2epGvhABIAAA&wp=Y0hI8QALcfMKj8UQAA9DU4zkhBLHda6W58Vhbg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 144331
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame 4BD3 127 KB
44 KB 234ms
227ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y0hI8QALcfMKj8UQAA9DU4zkhBLHda6W58Vhbg&u=%7C1RaB%2Fm8LhSeDoph3U6gxTsxOjklEZmzc%2F%2BKO5BsgI6w%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oVqw7Cvg7ORZ5y2n_PXned8JCsSCQ138ULuqTtuWjQY_gaY2FCscn6co4nuHkgNjvK6trnbjfmaZD-K11PYdnhl-eBQgNreQWpBOH9oj8Hp0JAooqqG4G-hgVwlAa8kBic8l19cHlYISDMYhW2QOAzRQBvlNIcYeTMdAO5m2Ke0LoYw7m7P1IP7KtInEKKP3wFnSdJLPV1vcUW4hWHwY2yaSMv5dF1fRDLoEOu1J5vkMxhdeoRV9NUcuamMbs7q5yxsZbJtEz0-q3cmSl47cEuyGkm9nWcIcCkBb1pO3-q6p1f_R5PY0xzHvBJ0_DrVo2Th_CXjKlclhRugWvV4jsZ33qJ8SmcndBG0qQWvbNHpEn6-unhNI6evYsDvKrJUkDrCJmonZrn868DLFMRVPZstpC1GuLpQqt0l0ty3uMUf_6satu4EYbem1hxihqFtS9wcd09NPCsBo4Ln5cF6F46-pPBn9AYUHjk2XsYafhOL_aPkaR7KkBGMagDgIUDdFNGzoYNI2FNJu1zuxH0b_e_VmFSYCfwxw0V_S9v5CCRAER4Lhvmm9dfC4QqlEd2p323ZerSEP4Hgh5__XEvZ98z61HsIGV4tFBjefItr3STF8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DClFqO8UhIY_PjLZCKvwTThr2oCpj80bFcqoTM5IUBwI23ARABIABgpcCjgKQBggEXY2EtcHViLTg5MzMzMjk5OTkzOTExMDTIAQmpAoZvK5eDHKU-4AIAqAMBqgSgAk_QlkzLbbuPeae9xHie0ryWAQaNqX_yYqEOyF7iEM4Es7IQ75K3VKwU72hWaRJJOlG9JJyTfxPqJMIvMeMJTabfiSBHPimwwQfcJRkuAxARd_cnTqBuee1YIFwobqZJPRwZfYX6yYgfLDyteSMUGXDMMlx_3hv7Mta4CeIbZ6mkmy1LnUKY8scxUECMBeG5o9BghRGbt_dEwxShjcssi8dO1QLZfx3vIAMDPZvSONe13dj0C7av9h8D-MCtZ2tYaxeuEicCMargZAG4Wrm56o3ldGAjlDOIBohzOVGchFVtYKlDFmFxin8sfJ83Zn9Eqf6qqguQTouImcZCvh2xwHTJBot6yFfHF6nSwy5qDTp9sih2_vMR6-uVcv_vr7TKaOAEAYAG0KWJuoG40cz8AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgw-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1rpzJwilcH0SMEqg8b9vh2tnWV4Q%26client%3Dca-pub-8933329999391104%26adurl%3D

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

052bfc2c215a2ba55fc62fbc2d518f41f051970ec9d841bb8de2f07a61cd95bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:50 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=3DH3CiPHRShdgZICRpNM3cFaAocnYWe-o8XVBcEXK3KmxP6T1vAj9qoq0DckPDaL1paD8St-mEPmAZqIPIfrF6o-JeD0sYcBIls-b-G3qprdh8PglOPF_vhD0vyIpvhUw0lEoAuEI7imFiq5_xpVSrijX39ZOlL_OEYeUpfC9i5CIRTr3SjzzVN3zniVPc3HH9p-QNnE4zQBXOwa7tAy-08yFP8FCqULJQCfvFSAFlADxCtSQlaeCzHMK6uAr_tbVpp0f7POuoYxWEsw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 58834177
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 6A4F 3 KB
1 KB 250ms
249ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/window_focus_fy2021.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 08:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30970
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 08:44:40 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1524 1 KB
643 B 174ms
171ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 56748
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 01:35:02 GMT
etag: 48472445140208031
expires: Fri, 14 Oct 2022 01:35:02 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/ Frame 6A4F 17 KB
7 KB 193ms
188ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7e54c08be2d3028420666e9aca9074537fb351e2ece4e32b925ffca1840ce12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47099
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7570
x-xss-protection: 0
server: cafe
etag: 17992891929817281641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 27 Oct 2022 04:15:51 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6A4F 0
0 220ms
215ms Image
text/html 142.251.10.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQQQMv4EUKmDHmmPgP0JtacmTRJV_WuGkhevwfEqFyG7FvYK-3WwOeREpfWeWK5Y_-L5GlD2J22CjJjgevphJFrXk-MQg
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 6A4F 22 KB
7 KB 221ms
216ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 18:50:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 253806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 10 Oct 2023 18:50:44 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6A4F 152 KB
46 KB 181ms
177ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ffb82a05bcd7e430f57b9428d2a6990f127948e7ff14d66c3784a84f4330ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47415
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1665574756386403"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:20:50 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame FEBE 0
10 B 188ms
187ms Image
text/plain 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?qbJ3yw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 42A4 0
10 B 183ms
182ms Image
text/plain 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?qHoOrg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4D8A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1&C=1

43 B
766 B

282ms
282ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axj0kqjUATAB&v=APEucNUj1NorSgkF5SJtNPQ1TNWJKzHxI0p2tOBOHb2EfcUjTw-Yf42O41Lry5Z43EmaNz6uISmnBZErIxcUCFI9sGhJxD4Zgg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4D8A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0hI8-reWr55Dv7cRZankQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1

43 B
894 B

295ms
295ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axj0kqjUATAB&v=APEucNUj1NorSgkF5SJtNPQ1TNWJKzHxI0p2tOBOHb2EfcUjTw-Yf42O41Lry5Z43EmaNz6uISmnBZErIxcUCFI9sGhJxD4Zgg
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4D8A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP-gvm2DDGSueqNpLWYfzVM&google_cver=1

43 B
1020 B

228ms
228ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEP-gvm2DDGSueqNpLWYfzVM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axj0kqjUATAB&v=APEucNUj1NorSgkF5SJtNPQ1TNWJKzHxI0p2tOBOHb2EfcUjTw-Yf42O41Lry5Z43EmaNz6uISmnBZErIxcUCFI9sGhJxD4Zgg

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:51 GMT
AN-X-Request-Uuid: 0484c862-f4c9-4617-99fc-6e27a1a2e6b6
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEP-gvm2DDGSueqNpLWYfzVM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 4D8A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D

170 B
243 B

280ms
175ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D

Requested by

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:51 GMT
AN-X-Request-Uuid: 21f25de9-dfe7-4df0-9ffb-a82bfd407bc2
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 753A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1&C=1

43 B
766 B

281ms
281ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axi8iajUATAB&v=APEucNVWb2wW8mBSlZ-zPeZpla9ql4QyKKjLG-AnLunSXmtInw99x9ftgNnx3u4cL9PLlBkvZAnW5Gq7XmtcVjYzxNtfbfncQA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 753A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y0hI8-reWr55Dv7cRZankQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1

43 B
766 B

295ms
295ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axi8iajUATAB&v=APEucNVWb2wW8mBSlZ-zPeZpla9ql4QyKKjLG-AnLunSXmtInw99x9ftgNnx3u4cL9PLlBkvZAnW5Gq7XmtcVjYzxNtfbfncQA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO_v8ItHuAddBl9-9M9PVN8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 753A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP-gvm2DDGSueqNpLWYfzVM&google_cver=1

43 B
1020 B

229ms
229ms

Image
image/gif

104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEP-gvm2DDGSueqNpLWYfzVM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COHNHRCZ4Jj4Axi8iajUATAB&v=APEucNVWb2wW8mBSlZ-zPeZpla9ql4QyKKjLG-AnLunSXmtInw99x9ftgNnx3u4cL9PLlBkvZAnW5Gq7XmtcVjYzxNtfbfncQA

Protocol

HTTP/1.1

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:51 GMT
AN-X-Request-Uuid: 34d95ca3-b054-47f3-b055-c2dd637614aa
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEP-gvm2DDGSueqNpLWYfzVM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 753A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D

170 B
232 B

249ms
177ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D

Requested by

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:51 GMT
AN-X-Request-Uuid: 77d46df8-9d49-4e54-a4fc-1a3084043c21
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5F45 41 KB
15 KB 170ms
170ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CRaMrIBql2whqkfuSIl6XIHdDCiDM4MgnAmD0T9OCMf7RkluzfEbOGkHfEfYniZKc-c0Vk8QO78RWGPnEegs4rbDsErMoLF1bJddG46tWNDh6z3pc0pRy-DbTg6NFmPXakbKXWM80aae7Hx_iZ2ZnxNvsHSyN4lAwMKzJ_PQAFcWp2Vgw&cry=1&dbm_d=AKAmf-CZ-0CjDpFBSqHHIxOTp_jJub7HiqV1FUlLShOrHtIcPopEd0hvghqyan5OrH7iCPvU1HxU3yOLvNkqRWQ6Q_ms1eHPMoRnfsYqUx5RiTeDEMoxFM4pvSiRylVO4H6FCehERQQt13UOVxWeEu0s0bnE3kESf3HwmCxJClFr0VafkZ04gTVdztCddWw31fwGRwSOn3JTF9GFh14o5Cl4OKDBQhNO3F26OTW_oWXqjNwdcVl8cbPNVJcAmBc7Op20atltzVBfd95csLli1cVwIZZhVGOmPUwK9DnnJVvulR7qVTLzJg6vBMVHhySU2iZr6A-NvBAOzEaeVAdF-x5TwO2puAtSDiPiwVhOyuefwkfJd49AW_sRhTwFPaEoNNFXMTPF37EO0Wq51vxXCMxPLIRJtDsQWAjlsMD9yYmT7FDlIPdBc8Epu6Ow9oMZN9pn54Kn60f09nVl29Qb7obEFbTMMg-DAqo11hEPOgJxkywWF1Jd494ECoHMtjoydSUTyHNa-j9pbWM0I9PJq820YPxH9rZOX6Fp_bZWWALs58pEHa_6d-dm7u2z04XuPU3bJRTxWCtHPZ-sMt37Q_BZXxVvXzGC-U85x1Hvl0QKXdu-gQHjjF0hVJOOKBQ2Itcj-Yi7jV2PZD2g1NVW-1QhltMxKZVzVFamyKCjpvrr7sf5CY6Lb-Ss7GJoUMFZFpBsB8q3KT7WPGfsZ23nm_fLDF5EDIeIReObOZKGNL-ysf-KTTzUUkKNxE3JyLvwyw-wX7CEbl5DjyBYcOmLh6RyLwF17w6-YC9_Gt1voibpq75SKuDtWS8rENF7BHS0sgVigL4XrIG3RmA1g_7at1MJxRd1-P3hGSMeq-SRdDZa9YAP_kr_CH-3y0skAgQ6LlyoGhxix_AhoWqsJWNPoIV5SMbdxEzmUlF8O8vDFOqSCbFUS1RNmV0hpIJDw7Pj9BrTNC3wFHMKHfy5Hwo_MxbmVmNJ-WMBrwP_El5ruBJ2wZn-MZCXiMQHCGLU7_0UBf8CW8Issp2J8Gf8YVB9Im92Gc2p94b2OG1abWtCjaHD3fUwMCLxOzW852segD3hh4fWRoIcwWuDXocy2FoaJTFk2z8hajiRLv_g5h8oxyUTAeGwHzDoXvoMYw3zbbiLCbcU7m_Uh3hmncCU8PqfOevun4Z-jqMsJOX7yzfkt9-tUry7dlYAZ9XzrcXIHxGIEXxlyem_2QLXHxL_EEQiFtrWo5hQVvAqxv6UZTyWrPt879vIRsQIHhzLM52vdNzob0NYz66jEDmC-QnCJfAW6iE55ka469gx0_enZr0B-YW-xrGx1RUkJlKalgzeFM7hnb9-iDUvntaOI8tlc1zh3zOCbBQT33aLIS4sKBpNMfRXze7Ptl6Att2GHrja0HsGdPjD7Jv7uBKXKap7Ve3HwzpUALjXptjiKimSiyp-EyIkSFSKWhA0M4Hb73vU3lEbp41jUvEjOUJsKHB9MWCmK58Vv1On-EZ5mBxfq-ZSd7JK8oFu5Fm1LhxNCLXDjdYRKoNlGz43avBpdPMTmbcCpaIzt4wIPGrNStixHu3D58QYsKQyzReJYWNzecjkKdzjoBjnQf_8jhcxwvZvSyt09o9Sq9Eow27-9xoRBpov5yIVi6gCuC1U17JH44tWbjrFDxRS_mmf5iXqsa1CTSMq-BKmYezCYBQ2fDAQ8oGrnc1eHnHQb0FCukfX1Mk66Eod6IFQOUyEYo6K3CfhpeytLYvw-CxWyGbou9GttqaP79ogcKMPfjL0e5_MGufaSB4DagiIxWoClDQGISYAZPxhEJpEcycJhJGlWcDOyCULtTWppSHLcMXY5OPFfwnEjGsLgumcEGEM9nk2tE5cvWGK6MGCAuivPP9UVVJWzRTeY_hCle3EXi6uUP1R5GM2gw9Yo3ImKDoHJytCCdstc2PdLTvv0E754z2eFfRtAqLhcJ5U1IYWTVMTGDVyD78gKv6BBLrkB_rha00aiVf8uqp79Fun7it8t2w3pYPXogmXItraOFy2jaEBqsbbpUGaIKvbjS-IEZLzfwbAOoYoqtUMLRxeHtoXf0bw7hV4jmmx4pP3cFL2FiUOM8hFRcIzShcbULTkIqfnK4L6LegpUtRYqr5efm1qxDSYu19ovYiZWX46-cMbLfeQJLHNNKuF2j0x8KXIZQiy8oJLAH78iCi3Eh0R41Ly0F3q098AiurXZ-cbxGK6dT04zatlD2K7x9aeq0K2gaTNnSULGGKDeEjXKzd9J5gWQWnOztdM6MqoGC8Qa3qZUAqL44sUFYvc2Sf50DGeiJEwupcITuuEosV5nNHCs-SeTMejOlbPJFLqZfFrdgqRy18xSBt8yjvCs_ue_ZWfLzwYrPldK9zEZn0_ShwGLdYEuqJ3GMZMaCUDpTr2xxhaQPZBTbeoieCc0u3IRqPB0upakV2K6FHd-SxoM-qEC214PL0igiNFDFvGE8Fnvkico7RKZfnmMbv0ADfCkPR5Vkryo_RDlTKAcqMdhMndhAuiv6S3juafiL7eHk46tw8rBhR3g9HAbT-Rd3a_66jPkCHD2GjMuRgk2IbYvyRyH-DYet1OD0v5gHiNOFKQfcYD6s64Xz3_vciuH3_4ufnYp6EcP4946J5Rn34lAfNyGOSRH_nBhL0KDuLdiNqu50F04IyKlh3-oJUaE2pBPRkYE553Z3Fkyc1QLbGzweNa8MjV60uewWgpu4de1U46m-oGLOpvC3dyScvgk_ALq2pBbhdP3EXTYBJtxAYDiudyzwZfYLLFeIyVuR0dSp3sX9gFvWuKcj76PmtNXn2ZCKraqPKr6Zri1oyt9ALekDDH1bsrxshj0RLtFtRti-VgyHx9oW1r-J2k3oxJzJP-MJ37XFY9XRycWaN8HBtuO_ZlYQJtpfncYT7tUcvus3LpzdoQ6giTFQOCaiuQoxIHoGzcE_Y9WzWS76AGYYmtbgPUXpYoEqQZ-N2dNfbMpIcPNPXjh1MHhvMLHcAWcdR8LKwV9j_0c3bib3vTc7uAf0lR3cKBTsRcnwgSK6lXXlbmF6M6-Ei8r7s7V0fNLr5zNkTl3L4k_iEFtgj1VdV3CVIpH8Z25vbOJu_ymHptBDZ5n0TZ2guYBmfo44Adue0WD3YB6ZwandukcSXxQvdJi6YFrb5fgPW0iN5svPZo_1gFLFAK2o527WmGudiOohOpfYi1VPuMq5OyVKcWNrWsCrAKdShlan9QA--P5CxTGgts6DwDf01DhbbBbhnhfVKKdpjLBBRCejMfCxSv8khbdAtiuR2acFYXlQ&cid=CAASJeRoZqdY8NualZ4IFFxajYcnzvtrbSnLv5ag-nqLdBTXPg3wPDU&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 11:45:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 365702
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:45:49 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1C44 41 KB
15 KB 202ms
202ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ckvfa0zSX66tXUECXzFI2N0GszFPewa-efsSYHZ3-KCLRoTgXQkDm619400PY4mgbqnQss5j2OigHhToWlVN2DFyBtnwiNULdMtd2uLIIjdZFxF5HB9TskX-6EzctPoKQDx4aQExRZ02wZSrTuVFaeVHyoOgxRHLD5HPldnVf2yHuuVAM&cry=1&dbm_d=AKAmf-BVLqQ3jEe9mMud4B7gNjatz5C0s3aKOae_E3KNNxkvXSIikOkkPgQ8C8XUz_e1O2vgFQ62dezed3u-9AjWz0zL-Goczzk11MicGOXiBX8PDKTVR5pA_ZKFaOYHQ1auMJSecGG2qyVZZX8-EHWIPNR8gDxee95elbG2Z0n6d1d2QO5ontojZLAtmuu2oSDOgz7vXJNneDvGFQDQRiii9CGUoqpcejFa8PMYoR3L6OR0JgaUDOsR52NgJ6sUkS3DEP5zh2sR7mJvgOAm_kZ7DnISwLopZjII5yiGng-ZCzb-JcP_GBoKxu18kG8XLumu1Am8EALQmOwsv_JQptB1DuQYXP9qsiTW6SwN2sBRHSTcXLNp3p9hVhMZyo5mRQKZzMFuwm4OX3_myk3jptEsMU8oILcfo_OtMqmae5xhgaCqd4x_fDdpS3l5Zt3sGtQO9eJnokfghn5x6uHjyOeqROd7kjVZi7PxXrh-7LJnDyDeRC931fkegwUY8nssMCJ10dXq9Dev12VrkvPqiFfNiYoLL8D5V3xD8QEPhKdTs7NP2JXM-nFHvAL7rm1-u1h3mpzfbZz1Ym0tyuqmNlHQp_geQlpD8xIQWrc0rEOI44bGGt61Fu2bBuj_rvwOVWiqeyntOu5aVhp8M9IvOgsChO0N8AdLarYUhFL3g-xRSYn46_CB9EGlbG2_JCpxuTMNpWYWcjpO_JqjyZ4nTSq7HMthgohzCVgnlBrf_RHOZIs0Z0k7YP368viSrnpXi17FCzMehXsoR0Sj8pTfi_OWtXSvhO4kMzuT0_Zcp08PD1K6yyFCytW4DQUpjLO4AFd0GSE33zINtbjj5CGzn3nR4qEyX5RMK6jnYVH0d3XIzYhL06jNTCqlWa5Xi2ARQbi3rZQOqu2ffuw2Sj4x-jGrqdvqLQ-hIkWopM8Lq40Rkgzs9GNFF0HUqySxSUDdPot42EAqTt-XOFwnuv-82OO0kZvZMf8VZ8Jo3yivOb_ScwrUW24LWld07tbI-idrv2l3lN6-Zt0iczCLUmJmmPyDv0CvpU-UCyW92c8gTU2el9ps7ugy6CyOjkwgARJ_vhhRsPiAjPT2PzrrgKdtYImXLMhk80nOtcJ2gYwj8ZuVgS7sQ7EgYoghkyIDIYHrC4Cc_emxM2g4IB4qltV809si3h20b4QZhE5Anz6voUSELW0uqedgjRYMiFgVkd2mCW_NvGwWnTO3BQmEs0Wl2EKFBLrHziiDbY4zUbQwff8pWFQRwVFIU6AwNfTxbe2j0U4FdihfZUNB02fWBHyzSBuJDhVugsXbFZX928n7uWUCwa7zVkJ0KHMCktMjgnHVRK61Fu9N-RBnnZz4amYacuJHu6bF0vgPihAbjBJaadrbucppcoHRwkuaPaFnNAPHP7fEN0TPVF1XI6xsXhAie7hXsmjEc7tfDvYsfbwMrCVt8j2k59mHH3zm2RYHjIHDmTFwwPl8o4YVVCfvMpso0C7MTkO3vaF8h3gAKQfFsHkYqg1A9KxxZwYBsLCkGkW6zy6RPtVsktJaugF1I-Er0Fxtp2eQAcD9Vd7AuhI3xONZvzgCQ_wMS7RS_5KDy40tLyZcWi2MdGDKVLca6GRDr4qJr5-mjbQxLG5VfyQeSlDRLvQ4OfH-ThsZkP8O0syyAWAJkBkQfp97NhbUpxJ3jMxjIuJySFT90cEgeGeZO80pwk8wmhMHHk5CRApLVmpm9D1kVUD74LQ3-eJVYqz3TTIr_ICqJiA9el5HpQ3wTWzE6ajnuuZyOrvH72r2JzH5_lEK0YPfP0ODECGy2msbtm0Rl_t0DRObc5hgcyAbUDMVFalRGrKW0VQTXwH9xT85J1TeXjl8V3WYWSCfWP4T2nzARG5wcm3T-y2S8qB_cfsoiafafz0pzciacPkwBqUnyeRfR1PrTyNYP3vgKxjXN0ejUhpR9CU2p90RPEuByktoldEs3aGpJ2OqX-zKPhUqFIbfckjtTgwuB6WeKHQk2kzDGEaFjvwCq_38FV32WQngBrq76FFfYtFlmwk1__A6E2TvYe20KbUDPvdKdRF7MIcAOmdOrwvzkD1GVx4c8z3Zda8aVWTxApZhCOaRLd6Z8gRbj7XcSKSLgAACcACN2FX9uiNvOoKWQQtegjHsiJrIIYFKwwdZpbcyZYNreVL_9N-w8o-xGzqpJV1K5geWo539xSZ4znrcQuQ9_bSDhXTnjXm2RFxCBQ99mLz9KGVYecgP-H5QcFT0Ehou5cfh21FKDdnZW12j-EmssbkDssN5psZxmHh3ywDgTleg53FAz_PrFlb3Rl8asaRyfcenz0YFcZMG6zB-E07wxUc7oVOLcrRmNFSCq2QwfkzcU7LEi9gcooo8xoAyOstdTE8CzZcovnjz86f01-DfoOYp_egy3RKa2YYS8YdI2VOY5HGDH6aaeKSZcGPjeSpsXR1eKew7BXtOCk4noNG-MMYum3afVHovJJ8KfZ5Q2Ff5j-eJBaMUga1RW2B86XDtt73bljvJN9PL8bne3HOonggNQk9EF7Hyj8eKfYB6EXFLhpJEp719Q9hSDGYvYSnBJNrmL5sg6eJqKAWNq9ETmAGc6jVe9ROThlpVw-gEqL2UD3axQZsN3UE19EFZnGPFo6TJ0HQsjo2KAdvWWPSrNVuqT2jJyqS0vNLsgjoTa7gE2fdQn7P8_rSq6dZL187n0cUQnNI_3JuIUfFZXhcnIEY8mOrsxog1rZ9Qp2eTbIDudcpb_1y_B60EjJ_uw9thHhpm8FhUVRVRjvySHIGZ7FA0_BLpX2GycZSGpDg_nq_y9MwCCiMTjE8fSPA5pk3-3gZUDGTn1nPI4bYwCh2DTpH-386sFdlzax1HcUxiDEFgHlIvaSzXpEh3XgFuAuGI2phoofFuMCvdTLPeCUu1074l1HZLQ4K3AoB5cjczumbxbRCDUDhenVm_pjbZrXPT8RlIRvrFB_606sKmJGYG0-kMS5k4gK6pbwplqmkC0ALKPaEaONyAG3AS2J0fcFYHBr4ZHzlk8d2ST7x-hAwVEJ5xB-lwIK90MiWXz2GAIsq1OiDWUXarYl5z2r1DUVVLnwFC4CM3p7cgqoMWAmGW7DvMf4TFRV7N3TSVx40BO2hVF3cY8ZwvCSeO27DAaH_YDbzs671to0lMU_Bo_p5zOqIc4EL5jgikk7R-ANfQXUexWE21Act6rNWdCNWK_H9_d1splJiImC1m0gnjGfz-zZNUEEosLYju9ix6GzIRdLKDMf-owRyO8pd2Z7i_6PYh5RAvD_og0RIZBEz_svQKrNtGuzwnwr3bdWkWPfs&cid=CAASJeRoPhpJ0uc6emOpZYOCHjqRiuSqRD10mNdd4XJRxq7dNfi7Wgo&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 11:45:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 365702
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:45:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1524
Redirect Chain

https://v9999.adv.admeme.net/drtb/n?google_gid=CAESEPLu3uT-xcG-_wpZ3Eisdl0&google_cver=1&google_push=AZmPxg9Dv-wbG_YLoZLAI24Lgq0NuetUpTWg9Dibwm7dVKhloHHp5qFnzWeX-6fH-3o-F_VK_Cfp0SANWya0KOKe-n7WzPz2...
https://cm.g.doubleclick.net/pixel?google_nid=kpis&google_push=AZmPxg9Dv-wbG_YLoZLAI24Lgq0NuetUpTWg9Dibwm7dVKhloHHp5qFnzWeX-6fH-3o-F_VK_Cfp0SANWya0KOKe-n7WzPz2RmHMybwI8c6_RHTHGpLSnWxnDiCuap7rSbcBC9...

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kpis&google_push=AZmPxg9Dv-wbG_YLoZLAI24Lgq0NuetUpTWg9Dibwm7dVKhloHHp5qFnzWeX-6fH-3o-F_VK_Cfp0SANWya0KOKe-n7WzPz2RmHMybwI8c6_RHTHGpLSnWxnDiCuap7rSbcBC9UUsZuWqU1NJj_-ZQYlHw

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: http://cm.g.doubleclick.net/pixel?google_nid=kpis&google_push=AZmPxg9Dv-wbG_YLoZLAI24Lgq0NuetUpTWg9Dibwm7dVKhloHHp5qFnzWeX-6fH-3o-F_VK_Cfp0SANWya0KOKe-n7WzPz2RmHMybwI8c6_RHTHGpLSnWxnDiCuap7rSbcBC9UUsZuWqU1NJj_-ZQYlHw
Date: Thu, 13 Oct 2022 17:20:51 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1524
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEFWLxvoihTcRLwKD1VF8h4k&google_cver=1&google_push=AZmPxg9mJ5sV35-ChU8_JaIbgfnrzM49awhJdY6pP5HK0MYYxoox-PrQsASxlvseSLp5kTzy_93QOds-nBrcM...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEFWLxvoihTcRLwKD1VF8h4k&google_push=AZmPxg9mJ5sV35-ChU8_JaIbgfnrzM49awhJdY6pP5HK0MYYxoox-PrQsASxlvseSLp5kTzy_93QOds-nBrcM...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AZmPxg9mJ5sV35-ChU8_JaIbgfnrzM49awhJdY6pP5HK0MYYxoox-PrQsASxlvseSLp5kTzy_93QOds-nBrcMEm22hwEB0Fx72pQc_CHrAErYy-h7LzDh9UUYkuNCakff6P...

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AZmPxg9mJ5sV35-ChU8_JaIbgfnrzM49awhJdY6pP5HK0MYYxoox-PrQsASxlvseSLp5kTzy_93QOds-nBrcMEm22hwEB0Fx72pQc_CHrAErYy-h7LzDh9UUYkuNCakff6PTn1RM6psl2vgvP4FLFljw2GQ&google_hm=MUdXN0tPYThoMnhzT01BOFVocFE=

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:52 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AZmPxg9mJ5sV35-ChU8_JaIbgfnrzM49awhJdY6pP5HK0MYYxoox-PrQsASxlvseSLp5kTzy_93QOds-nBrcMEm22hwEB0Fx72pQc_CHrAErYy-h7LzDh9UUYkuNCakff6PTn1RM6psl2vgvP4FLFljw2GQ&google_hm=MUdXN0tPYThoMnhzT01BOFVocFE=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 291
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1524
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENY5vIa6EqtGrOfE0sXXJI8&google_cver=1&google_push=AZmPxg9bvzKBmb15LESeU4D6JxuWmrVZd3pL_-4bIHW3Vz_UMXNSgtWu4dDPnIljhemyDX8rGKtpLoL2BAXH02FMpVB9Q6lRvr...
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=0&gdpr_consent=&us_privacy=&sync=1&google_push=AZmPxg9bvzKBmb15LESeU4D6JxuWmrVZd3pL_-4bIHW3Vz_UMXNSgtWu4dDPnIljhemyDX8rGKtpLoL2BAXH02FMpVB9Q6lRvr3...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Njk5MDc3MjEyMDIwMDI0OTQwMjcy&google_push=AZmPxg9bvzKBmb15LESeU4D6JxuWmrVZd3pL_-4bIHW3Vz_UMXNSgtWu4dDPnIlj...

170 B
188 B

363ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Njk5MDc3MjEyMDIwMDI0OTQwMjcy&google_push=AZmPxg9bvzKBmb15LESeU4D6JxuWmrVZd3pL_-4bIHW3Vz_UMXNSgtWu4dDPnIljhemyDX8rGKtpLoL2BAXH02FMpVB9Q6lRvr3lFW0-nj_JHEui9qax7c0cNidylQJlkWQ-uupLpspSadlbsxn7W_BQ39Q

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Njk5MDc3MjEyMDIwMDI0OTQwMjcy&google_push=AZmPxg9bvzKBmb15LESeU4D6JxuWmrVZd3pL_-4bIHW3Vz_UMXNSgtWu4dDPnIljhemyDX8rGKtpLoL2BAXH02FMpVB9Q6lRvr3lFW0-nj_JHEui9qax7c0cNidylQJlkWQ-uupLpspSadlbsxn7W_BQ39Q
date: Thu, 13 Oct 2022 17:20:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1524
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEJxbQORFrQeLEpHe570vEzI&google_cver=1&google_push=AZmPxg8WVDkJzHdAEOHzAnnju1X7tdI-aOGtsfKEQQ7Bbq4e6MBOpNzmwEOGm8gsbAqVcWJCDcmG3X...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AZmPxg8WVDkJzHdAEOHzAnnju1X7tdI-aOGtsfKEQQ7Bbq4e6MBOpNzmwEOGm8gsbAqVcWJCDcmG3XZW6ZAahyuYBOt5ewpHRLWmYuDGaFP9bMKgtacj_EEzb...

170 B
232 B

477ms
176ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AZmPxg8WVDkJzHdAEOHzAnnju1X7tdI-aOGtsfKEQQ7Bbq4e6MBOpNzmwEOGm8gsbAqVcWJCDcmG3XZW6ZAahyuYBOt5ewpHRLWmYuDGaFP9bMKgtacj_EEzb6qHIKwsqNFKGu9ObTy44k7-y9CWN94sMw&google_hm=NjUxNTkwNDU5MTc2MjQ5MzYzNA%3D%3D

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AZmPxg8WVDkJzHdAEOHzAnnju1X7tdI-aOGtsfKEQQ7Bbq4e6MBOpNzmwEOGm8gsbAqVcWJCDcmG3XZW6ZAahyuYBOt5ewpHRLWmYuDGaFP9bMKgtacj_EEzb6qHIKwsqNFKGu9ObTy44k7-y9CWN94sMw&google_hm=NjUxNTkwNDU5MTc2MjQ5MzYzNA%3D%3D
date: Thu, 13 Oct 2022 17:20:51 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1524
Redirect Chain

https://im.bluevoox.com/pixel?s1=2&s2=203601&s3=m52eksbsgbowze8o&cm=1&rd=1&google_gid=CAESEKKDVSl6tt3imwp1S8WAVRE&google_cver=1&google_push=AZmPxg-vapGxAp-N3NVTsRseHE7HN6ymXraoHfdl-zWNPW_rQYSL635IL...
https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AZmPxg-vapGxAp-N3NVTsRseHE7HN6ymXraoHfdl-zWNPW_rQYSL635ILW-tYlAVwBpBr7cfz_HNuBSPEFeb722PJ-7eA7Toa-8fMHalNMAlxNlOHJlveXJUhRgcbVcFd...

170 B
188 B

174ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AZmPxg-vapGxAp-N3NVTsRseHE7HN6ymXraoHfdl-zWNPW_rQYSL635ILW-tYlAVwBpBr7cfz_HNuBSPEFeb722PJ-7eA7Toa-8fMHalNMAlxNlOHJlveXJUhRgcbVcFdl8lGnHpmNjPh1xsvGmo5wceaZR6&google_hm=QlMuNzE4Yy1jOTkxLTRhZjMtOTMyZA==

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AZmPxg-vapGxAp-N3NVTsRseHE7HN6ymXraoHfdl-zWNPW_rQYSL635ILW-tYlAVwBpBr7cfz_HNuBSPEFeb722PJ-7eA7Toa-8fMHalNMAlxNlOHJlveXJUhRgcbVcFdl8lGnHpmNjPh1xsvGmo5wceaZR6&google_hm=QlMuNzE4Yy1jOTkxLTRhZjMtOTMyZA==
Date: Thu, 13 Oct 2022 17:20:51 GMT
Server: openresty
Connection: close
Content-Length: 142
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1524
Redirect Chain

https://trace.mediago.io/cs/google?google_gid=CAESEAhcS6g9TIYrvp-ZeWJrxt8&google_cver=1&google_push=AZmPxg8r4cmOVbh1UOXyZDNZGzSlSR7f9udFRR07CEgUjjuYAzVbYuiA5IujtzhJPUA3DPki9TuFTqNZRwocHzMuQRQk_DpKO...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AZmPxg8r4cmOVbh1UOXyZDNZGzSlSR7f9udFRR07CEgUjjuYAzVbYuiA5IujtzhJPUA3DPki9TuFTqNZRwocHzMuQRQk_DpKOpHwJBeh-kloWCVhMG6dQjWTWsgYF...

170 B
188 B

174ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AZmPxg8r4cmOVbh1UOXyZDNZGzSlSR7f9udFRR07CEgUjjuYAzVbYuiA5IujtzhJPUA3DPki9TuFTqNZRwocHzMuQRQk_DpKOpHwJBeh-kloWCVhMG6dQjWTWsgYFJKWOQVgdL4CB9GN30-2uJsmNsCRrjs-&google_hm=973d51a4695309227ceb79865bda39d5

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AZmPxg8r4cmOVbh1UOXyZDNZGzSlSR7f9udFRR07CEgUjjuYAzVbYuiA5IujtzhJPUA3DPki9TuFTqNZRwocHzMuQRQk_DpKOpHwJBeh-kloWCVhMG6dQjWTWsgYFJKWOQVgdL4CB9GN30-2uJsmNsCRrjs-&google_hm=973d51a4695309227ceb79865bda39d5
date: Thu, 13 Oct 2022 17:20:51 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 302
content-type: text/html; charset=utf-8

GET
H2

200

dot.gif
s0.2mdn.net/ Frame 1524
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_push%3D%25%25PUSH_DATA%25%25%26google_gid%3D%24%7BBSW_UUID%7D%26google_cver%3D...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_push%3D%25%25PUSH_DATA%25%25%26google_gid%3D%24%7BBSW_UUID%7D%26google_c...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_push=%%PUSH_DATA%%&google_gid=51156692-b53f-4d50-a156-5b806a4b8444&google_cver=1&cookie_age=0
https://s0.2mdn.net/dot.gif?cookie_age=0&google_error=5

43 B
181 B

470ms
169ms

Image
image/gif

172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?cookie_age=0&google_error=5

Protocol

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 11:41:07 GMT
x-content-type-options: nosniff
age: 20385
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 14 Oct 2022 11:41:07 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://s0.2mdn.net/dot.gif?cookie_age=0&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 256
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 1524 0
223 B 454ms
173ms Image
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IlfpbDt06NV69sjo7vxKgKqqy-B2nNgv1zDZAYxSysVdAxw8MyHwbMt_df1FTW-DWNENmCRRcw

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 4BD3 2 KB
1 KB 171ms
171ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y0hI8QALcfMKj8UQAA9DU4zkhBLHda6W58Vhbg&u=%7C1RaB%2Fm8LhSeDoph3U6gxTsxOjklEZmzc%2F%2BKO5BsgI6w%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oVqw7Cvg7ORZ5y2n_PXned8JCsSCQ138ULuqTtuWjQY_gaY2FCscn6co4nuHkgNjvK6trnbjfmaZD-K11PYdnhl-eBQgNreQWpBOH9oj8Hp0JAooqqG4G-hgVwlAa8kBic8l19cHlYISDMYhW2QOAzRQBvlNIcYeTMdAO5m2Ke0LoYw7m7P1IP7KtInEKKP3wFnSdJLPV1vcUW4hWHwY2yaSMv5dF1fRDLoEOu1J5vkMxhdeoRV9NUcuamMbs7q5yxsZbJtEz0-q3cmSl47cEuyGkm9nWcIcCkBb1pO3-q6p1f_R5PY0xzHvBJ0_DrVo2Th_CXjKlclhRugWvV4jsZ33qJ8SmcndBG0qQWvbNHpEn6-unhNI6evYsDvKrJUkDrCJmonZrn868DLFMRVPZstpC1GuLpQqt0l0ty3uMUf_6satu4EYbem1hxihqFtS9wcd09NPCsBo4Ln5cF6F46-pPBn9AYUHjk2XsYafhOL_aPkaR7KkBGMagDgIUDdFNGzoYNI2FNJu1zuxH0b_e_VmFSYCfwxw0V_S9v5CCRAER4Lhvmm9dfC4QqlEd2p323ZerSEP4Hgh5__XEvZ98z61HsIGV4tFBjefItr3STF8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DClFqO8UhIY_PjLZCKvwTThr2oCpj80bFcqoTM5IUBwI23ARABIABgpcCjgKQBggEXY2EtcHViLTg5MzMzMjk5OTkzOTExMDTIAQmpAoZvK5eDHKU-4AIAqAMBqgSgAk_QlkzLbbuPeae9xHie0ryWAQaNqX_yYqEOyF7iEM4Es7IQ75K3VKwU72hWaRJJOlG9JJyTfxPqJMIvMeMJTabfiSBHPimwwQfcJRkuAxARd_cnTqBuee1YIFwobqZJPRwZfYX6yYgfLDyteSMUGXDMMlx_3hv7Mta4CeIbZ6mkmy1LnUKY8scxUECMBeG5o9BghRGbt_dEwxShjcssi8dO1QLZfx3vIAMDPZvSONe13dj0C7av9h8D-MCtZ2tYaxeuEicCMargZAG4Wrm56o3ldGAjlDOIBohzOVGchFVtYKlDFmFxin8sfJ83Zn9Eqf6qqguQTouImcZCvh2xwHTJBot6yFfHF6nSwy5qDTp9sih2_vMR6-uVcv_vr7TKaOAEAYAG0KWJuoG40cz8AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA8ggbYWR4LXN1YnN5bi01MjM5OTM4MjEzODcwMzgw-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1rpzJwilcH0SMEqg8b9vh2tnWV4Q%26client%3Dca-pub-8933329999391104%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:51 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 4BD3 2 KB
1 KB 170ms
170ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:51 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 4BD3 308 B
636 B 172ms
171ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 08 Oct 2023 17:20:51 GMT

GET
DATA 200
OK truncated
/ Frame 6A4F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ca037ea704da1c9f2393146edad303cab415a170cd91865213cd9eae08148f07

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 4BD3 293 B
621 B 172ms
171ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 08 Oct 2023 17:20:51 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame 4BD3 43 B
347 B 172ms
171ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=lM0OHxQKyxqMcxW6LErfBJJ4KN3iptVrBcafnQJ_3vC0w29gh-v7oIRX2cnmKT5ysX-eakfU3oVH9n5-K-YQeyy_vHq-qJLr5k_o_zruaOrERHhibwQjhTczdc_Sd7loQ4CAsR46TSbAHsfVcI7cj-26mzDZxhPuQJ2QixDmpUpxApnbLtsL4EF_C7cp6kFGTzapqR0mo-PcKd4l_6eo8Uv1X9202ZCz5KtlPun8qPxha9EDRyrb8OnJ6zSmqEz8GJofpiFF7qNQKKLQUI0wMFHQ88Phi2IXS0OoAr1i91Poe9MJnc_pZbD7ImtdJfkVgyPfW91JwqGltVoHRQYbXMgbIfXCX_cB67y8Yyp-RlSfeDpwa4S3E8wDhnxttohiNKK_B86fyp7w5bSntHXPwkig99N8A7zBoHf1m2_LI3KDIUOz76078b-HS8w0EeBhBacHXg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:50 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1602487
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 4BD3 12 KB
5 KB 185ms
96ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 75123
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wNOuNZ5l0WqqZos%2BATmqnby01oTsibAFIltHOX8sVTmbxqbw6HSlWK78wC5SWIFWP5b7IRF1ID8oo4Fo2N8kDxtk5%2B%2FfS3saw%2Fnim1lWqKR60qQK8T4kFFhb22aP3RWkM84P0lnS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7599bf8fbfd55a98-MEL
expires: Tue, 03 Oct 2023 17:20:51 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 4BD3 12 KB
6 KB 178ms
178ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:51 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 4BD3 996 B
1 KB 429ms
428ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?h=110&m=0&partner=37606&q=80&r=0&u=http%3A%2F%2Fstatic.sg1.as.criteo.net%2Fdesign%2Fdt%2F37606%2F221004%2Fb55902bf9aeb421aa470519d38a19296_logo_n_square.jpg&v=3&w=236&s=i0tLVhGlNoCOVST_8hp72JTG

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

b40e9a2326b74236ed25fafe232ba68ba825f33e6f75fb15cb687f5f0f794124

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30332879
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 996
expires: Fri, 29 Sep 2023 19:08:50 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 4BD3 147 KB
148 KB 181ms
180ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?h=1200&m=0&partner=37606&q=80&r=0&u=http%3A%2F%2Fstatic.sg1.as.criteo.net%2Fdesign%2Fdt%2F37606%2F221004%2F38d21c7f8b104b2588cdafaeb7147838_img_vertical_01.jpg&v=3&w=1200&s=1rx_-pnYPP3AGEASVBPUFb2C

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

ca7f9ff35e367881ce703d0051f63e9155521e2df561669a76a5f50a5e41e341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30332622
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 150980
expires: Fri, 29 Sep 2023 19:04:33 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 4BD3 33 KB
33 KB 401ms
400ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=37606&q=80&r=0&u=https%3A%2F%2Fwww.forevernew.com.au%2Fmedia%2Fcatalog%2Fproduct%2FA%2Fl%2FAllTerritories_OnBody_27530001_C.jpg&v=3&w=400&s=wkUt4sFlQFwEWtlX7r91R2dj&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

8eecdd2654615307994ff9ab5b773ce31052508f5d3b4c9fb0236a83e5032f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31100087
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33618
expires: Sun, 08 Oct 2023 16:15:38 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 4BD3 9 KB
9 KB 416ms
416ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=37606&q=80&r=0&u=https%3A%2F%2Fwww.forevernew.com.au%2Fmedia%2Fcatalog%2Fproduct%2FA%2Fl%2FAllTerritories_OnBody_27591103_C.jpg&v=3&w=400&s=3UhsvSGvi07hjoDpxgYYQfuY&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

cfe8c6ad6e88677ff13ec2fc154622f7c4c4730ebff4bb6899288c31edb82729

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:50 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=27860351
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8984
expires: Fri, 01 Sep 2023 04:20:03 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame 4BD3 0
127 B 172ms
171ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=3DH3CiPHRShdgZICRpNM3cFaAocnYWe-o8XVBcEXK3KmxP6T1vAj9qoq0DckPDaL1paD8St-mEPmAZqIPIfrF6o-JeD0sYcBIls-b-G3qprdh8PglOPF_vhD0vyIpvhUw0lEoAuEI7imFiq5_xpVSrijX39ZOlL_OEYeUpfC9i5CIRTr3SjzzVN3zniVPc3HH9p-QNnE4zQBXOwa7tAy-08yFP8FCqULJQCfvFSAFlADxCtSQlaeCzHMK6uAr_tbVpp0f7POuoYxWEsw&sds=2&rev=83153&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 13 Oct 2022 17:20:51 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 4BD3 2 KB
1 KB 170ms
170ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:51 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 4BD3 2 KB
1 KB 172ms
171ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 08 Oct 2023 17:20:51 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CDF2 0
0 172ms
171ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221011&jk=1075327899981005&bg=!NjWlNXHNAAYqRg79CkY7ACkAdvg8WrAjpOrEiWWHTPuN0OZY6YGTpoK5WNujuIjEOtY8lgIWQp7ECAIAAACGUgAAAAJoAQcKAA2gzs_UvZigye0VZu8xmQK3BJsHmtJqcXoZxtD6ZeG-6bKVhnpZKVnyXB81XJ3hGc8CY3fDC9sLzloEfh8SZKxO_rcUChGkk7hf0DZDMK_ZVqAI-smjbIkALKSfJjEp8427OopiaBIeeYBMbGJBHPAKM_Zka8sWFK4OojKXx0oQb_SVGPj_2WFqlahTFY1zRj3krNJiLk78glb91qoncO898tcVxj1T1FQ5ACEJWKGqh7dTpVQs845vv-GwOxMIjeNHjZDw_iav0Qhn1iLzfcLqUvTqvbzPQIDMzuK3rR65qLjHrBWo-fgIdja-P9xqpMDZiCINiEn2fYbKAiOsR4-Mb2akjOJ9xqpZ6XIv3ZVOo8C8zFdG5DkXxXf-jkhtirml4ELiURppzG1__hqmQDz2wl36x58mWM3D9iTByUAhGYfSiJQaiW9jJa7-B2ChbP1WsugCKa1l4DMVHtQT4XnrUmovLDIgXqu2MkQboiZs7i9QzOHKXwAD26813r3E_2WKfbIAB9U-KPmYMw0FHp-Df6ArBTtlruMhT99rf-HIrcjM__2DIf87AcYz9-x5gUl9Rp5ATJy6YZMtPXbxGuLwQf_P0NlV3NFylTlndsjmK8yevoOy1jzPkjnT2tmW0Ys8-5mAxH68pxGdmbxPb0Q_E-lgg1OjEwLwlakJavhrVJE7c6MXDAeYBvXu19qDI5lBQJoIUrHyLYBMqBwdFc5Tblgpmfxhivu9PQmlf1SXIB2MpWlgPnUFoDvLHrCm7EpMydiesNzc58tumOdr9lBH_U7SoNOo8AxrQdlQaKwYLNcB_y2cte77eIG3AddJbaBUF3pzBg_QQhtn9QQmYk7v6M9fqTrSdwFPizghm_7C9T4GUyTAsv7JybzrG188lh5o93CuJAZMAOEg0HEjIN2_QpVuYXdFHLrQXlB2cyWpAh7PnLaRGS8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4A08 22 KB
8 KB 171ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 567015
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 07 Oct 2022 03:50:36 GMT
expires: Sat, 07 Oct 2023 03:50:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 900E 22 KB
8 KB 170ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 567015
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 07 Oct 2022 03:50:36 GMT
expires: Sat, 07 Oct 2023 03:50:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 4BD3 3 KB
726 B 474ms
173ms Stylesheet
text/css 172.253.118.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8d683e97a1f23650a3e38cf3621b924ccf692f2a4204d193335ceddeb9b65353

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 17:20:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 13 Oct 2022 17:20:51 GMT

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame 4A08 36 KB
16 KB 168ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215350
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 38ED 0
0 172ms
171ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221012&jk=4393964291990564&bg=!1tWl1ZHNAAYqRg79CkY7ACkAdvg8WiVcqHMe0U0MgUd-_AuSxOGKZHAWrjm7ZwcOEy0locrVIjSt_gIAAADhUgAAAAFoAQcKACfWnlDbsbWV8f5PUMLD0rLW5WkwyzuGYp071iKQWEoBfqwMwGbI-AqZAsXw54ajuF8JoZyXkn3nRth0y03ed-zLkto4qet24fHvYl2ZHs4B0npZxZRQ9SusnZ80QmYFkJDo0F3o14L2eGr44J0VHO1VA0fOTzsgT3R4mRPW3_iZRVnxO5AFXHUR4GVX1GhO9EiB58UDlNwLcfGaYMjL6S77yV65de-LZtCl9VCrJSOh_fCv5fKVmd5HRKS_UZbOZZ_8zU1PZRKMsnbG9XALuwTMJMULcykkfV3Sm0qWoBlxcq3HU6NWg_HPISkVXW24SZvYz9jhV0c_DXSYAQgZzRc3Zji3y9iS7o8mYKOhirTroETGasr8Tgx9m1kLq3Uyf1AqWnBKwdZScmhGx7G8WQ9_P56kLa6Y2gJoqea_wOorGNz1MJUL2sqDAf-3G7GmRy_0G28H0XY-1E6tGz_lS3v4dBaANX47tvDJ2WKyc3oHpBqirDiMxBoGOu1lZLYI7aZKeomFnO3MZ81EKFSrOfv4gveT6i3RAzd-9gdfj-ruVtj42NPuvrHZBfrVcrmKg5tOfrruiud8253UzgDifYWXN_3KNhu6J4aS4PqNh7FkT6IBVQ4PYUNHND4rMnmdE-Yfny4-2OraQIiY9tsf6jFj8-fHapXDFrrmkOgLDuLlYywlI5jQGXc8NXFbUVh6VabIqdQ5BSQ0wM5u6wQWM5jnQw3igrZmdVIE0Kvm4o8vfdIxVpa-jgUR6q0v81eJ76JtLvjXv6SI7Rv_TZxCT1uM11_eCDQTpoWaL7emgwrJ6hRD69G2y-7wCU7gANX9ozApmm0yA_h-KnpJCok3Ti0-JZRJMeaDyo2kOsj-38E9u2gr8ViQ6R25vhR8h9MEVBDbW9N2nfOn8IoJM0mhIjyifsWPsaRveh06VTdcwslYyvL4hmyb1bWwYEWrrDozLtpKm3QpUQMcGGUINAayaD4_F4-CbGs0G5fwgpjSS0yP
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 171ms
170ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022100602&jk=1973977989840561&bg=!JSalJmLNAAYqRg79CkY7ACkAdvg8WujU2AwNH8fGT55i_uYFMvfu2lt_zHEZGGWqWc2ZM7oYL7SnXQIAAADVUgAAAAJoAQeZAp004ivJu2HlHlAd7qGCT8MDL0bSoa5HaowpehsRsHJFAoXXTr9d9buCh3ATvMvI6zLfIGIzXDLYrfFwKgmzIc56BthvlYyZEG1ExQ6hbxAegkyQvYe5JKD60ZDmPt_DXtFu6YYmKVMZLUN4mhCvvYN-77JyRT3cgpmWSSOzbZ37XktMznuq4Bmur3N_FV0S-FpDdGSpN5vEtxBzqrNh3sb8vsr2gSYF-DmCimLl1FgYMNZtOdsgLBhHtucyHQhGheEcZbx9FP7itbE2i7_rLr_8aMPJNw83ibQWISBeVg3jKuQabQXUn63q-S1Qr2E8DiFyf1CBFBWojxtJB_QZHh747nrerZ9vIVddpqdwY0LOtdK453D3ilr0w39uiXuMJs7xomBtuWeWvYCfyL0IKh5hxc7CobM6KWbty2n4KRc3IafeLvZFmyohJlQ4YpdQp9dOghDLjy_cn88SFGdEpKnIm5hG-51ixgURsx7_qO43CTidsfQtX7cLSydmPCT_K0NYazHpKlJdFBocJhNkYDOhcDozA9v-j9eUlEC-4nSFNEVlU8aqxjsTKa4zhKN46gYf5Hb2Umy1SQWQgewszN9tP1dTVGdY_Y2kMuxHdDrf7rFSQZbiRtsazq20IDlzHU7M8zZP_WSJELNQHrOzl5nUCZMmL6KL_4HCmf14vLb85dt3CXdBC5f-xlRnG94J8XdXG8MNYp616TC9xr0w2VaqAKPhwZ23h81ik-X_ocG2CNqgVM9z9t6YfuxTsOWAyNym48ZL3EhBBtoxzRUJKMrIgnHr3dDg2xCuWnc84IpWYbuMgEwUw4mcXOel33o0Y_uPxAN5DXW1d8WLdFRqlcF9Zc7eMwQC-_9wvtOL4sgnt55lgNFzNk5vncEEg1s
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame 900E 36 KB
16 KB 169ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215350
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 174ms
173ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 29 Dec 2021 12:30:46 GMT
server: nginx
etag: W/"61cc54f6-15c19"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 14 Oct 2022 17:20:51 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame DC80 15 KB
6 KB 517ms
171ms Document
text/html 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.bg3.co

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

3b699c2cd84c5722e0c9f34ec0c60a9f548901168f95d86b4f1df433a7b5cc60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:51 GMT
server: Kestrel
server-processing-duration-in-ticks: 510215
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 88 KB
29 KB 512ms
171ms XHR
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

b39c934479cfe0991a6eea4f9a0597eebea9da311d8ca1aebffd48fef946b5b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:52 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Sat, 01 Oct 2022 02:55:29 GMT
server: nginx
etag: W/"6337ac21-161a8"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 14 Oct 2022 17:20:52 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4A08 0
20 B 174ms
174ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BPJmG8khIY9XbMOKF9fwPkpaveAAAAAA4AeAEAg&bg=!trWltfHNAAYqRg79CkY7ACkAdvg8Wg4Ve5MkpOVlTykECsZqr44IJtsw_ujLKAjVLorkWMv_BvxdtgIAAACIUgAAAAJoAQcKAIrny8rHhwiXyofTc9-KTqvvTazkpf3X4VUqV3sDtZTAL9dX1OXK4PupHsIhH51Ng1LWaYprk1lE6Kz4iJJBFWasHyVWvHJYjUHcptmrnSPERnMmBFLyZA8XFrqTG3KZTIwB00KktB6u1jX9_nfa41HCGnfFS4Su4_c3XhBI0DkKfiqsgXlfFriZKRCZAvFHmbGTPJOg0-F3G7C7LRyGP_DF03_rU_jQLlgGA7kBUXeknt64v0kYG-izEosUHXSlopqFk3qi2LFwQkgbdGWzPqdNCgkaftT47ZImHFzuyYifHKgZOhzMHmI4pF_fcULgbhqs0sBO2ngko8kx7EPGisPMNN5AgNbiR2xkXwL-lEclAPRBlb-tJr-dLxYOS3p8BLzFsqQd1ieZNa2Nv6H6DJ_w5OXgTwIbYoiUnv2KBWonWo_bGMgqt1R0BKU_89m_oSxHOknp-tTY2XOK0PltIYF6q-O-jYyu_Tysw0BsdX_0NypqG35Fr3koUETUyM1fGEyqLDPnnArWrRiNtZDJj-xGRPd3LUJbtBlbEHq08Awq8wqflblxqqaG0cH8RqQHGmo-OOnAWM8ym8tBXNfRk6VqVD5RaLLidLusvIWEJiq0TWrVzX8x1u6yIRn6AM-3vf3Vt5KwGwLuvKVjBfn9zGFdJuodffEAv101SSuqZcFndh_V9D5g3lyvGkg33wfw0ge137lqPeCL-jo7-lXZu7BspPBO00S8tWs_-VXISv7mLtASOcHypjaLrsl0rrM6Di4S3LXtM-rPP6dpUx3S8zVikl2bAtRM7NuHksriB2acO23luuidpMgI8tkslyMg-Lwf1ao7qXREcqyZ94ZYsXRGk25rIzlN13U57OA01FjgWIR9WWaetYZCeRTaXPJpIByXyWhzr3hnXieHW6WsYcfPt8_43rLSzJqS4jmXGn09ooOj-CzLn234ZKWGtWPGAghvYTgpnt4ba_MxCII9PKTa8u_bq5aYi9oQg2x--PyfNk2u_aVEs4FeHKlrF1l3sgos-1sjbeLAyKjslZ7R6y21Bk8B_8loIXXQ2Rw4e-ENsP1j26qMeGszsQQzKWtwff96IjxGMkcTL1J8-6bA_UjhCsyrndF7azZKCFqTjwd6J-bk9Higz2bDSGiT-5FFm0PTNPj9HPHkYS6uW_74MuYDafIbmHNRyHzN0EpUMmU

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v34/ Frame 4BD3 16 KB
16 KB 472ms
171ms Font
font/woff2 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.as.criteo.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 02:43:22 GMT
x-content-type-options: nosniff
age: 52650
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Oct 2023 02:43:22 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 900E 0
20 B 172ms
172ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BFblN8khIY7izMq7v3LUP7OGgqA0AAAAAOAHgBAI&bg=!AwClAETNAAYqRg79CkY7ACkAdvg8Wt21skGx97jUio11IhJhIWvDjMFaaEAjiYWUg0nunQxhPQsQJwIAAACKUgAAAAJoAQeZAunLesil1SE040PZaD1skBwpqTOWBHWxNJ0I-z1tVW9DDYgQeld7F9ML-nNofr1j_FsvGUJ1RQ-_qjaVdDYtHG464CxpKlu5Ir1fqCDN7McpDfuxxUH5Q2CNwHjXEWG52L_O-9ucOrkM2zY_zz2hy1-EFrj4KNX5cExQrcrjuIrONgOW1sX7IubDSwXBc9tsAR3aY598Z-cC5cs6Cht1JRc-eLYpSp-Cyhp5oV8ycvkQKzv7vESFSXAfQolGyCBuS7qvZDc9bQo0T3W0wh3KBBziiMNpmn86S8dlRYK8FOSbQNXvLd9b5gbotVmlt4LEBjlv2X9V9GuvLrha8z-DggmXRJNwEVltaaKCGVDd-ekkY-j-7cGpcSShr2kfiElvlvOSs7NRezz5ZCIClug9ev1vCjsLi8D43LyKmFZ2JDR001uCXlL8qPX1-1UbaoUbkjQXjN73f-ljlP0xXmZMR1CaAH5-5O1aKdbE7SWpNC4Q9LeYOjhGLQgEph2-Mzj_XcmO_3kOZkRDNSbaEWd4tnCSmkKyilCHmPIp1fRokmFf3gX25X-287FQoXFetRYfViX6yr1-PR-Vc4sGYe6HcP0LYUn0Y9lYQPYC--6EV5estN0EyxErRgkUO8PPAmVJlCTjo4NVLZe1V1gmhdvkZ9y9pl8ULTe-os56kAVLueZZux2dului5TTJzP6BHeKR-PhbLQLyHZsmbIKPKTolGdpe6M3TgABR1uSCnv_XBq937_VQh5i7Yq8Xktm8mte02WCVR_s2lLW5W2O552GAyWBLqF-R9Dln3Qab6MwByM39xRcgZHiqr1u1goAlSGyN8ck2Nahcz9MkFsbGGqy7a94zxs8Rv6uOYKQKTAQDrPJypSCF-Bq4pH3aRvP3glWhjGk7KjyqvR4_KJTyvLK6vgvhEaZmsREvqeXZufZ7D78fbwFyz3hJCkqkNMnBiwMnQDR-90nSvgG0PvbzSFBrjBh1-sjweu21eD6k

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

dcmads.js Show response
www.googletagservices.com/dcm/ Frame 1C44
Redirect Chain

https://fw.adsafeprotected.com/rfw/www.googletagservices.com/1193990/66063505/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bg3.co%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9dd...
https://www.googletagservices.com/dcm/dcmads.js

28 KB
11 KB

169ms
168ms

Script
text/javascript

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

250686eb4f9e94b0bd0812e4e65b239b3355af85e21aff1dfaf3914f8b99f8f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 16:54:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1590
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10831
x-xss-protection: 0
last-modified: Wed, 21 Sep 2022 13:41:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:54:22 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: app01.sg.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://www.googletagservices.com/dcm/dcmads.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 0BDA 91 KB
23 KB 1081ms
374ms Script
application/javascript 18.155.145.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.145.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-145-129.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 107d9675170d96f52a4921f960f44e7c.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-P1
age: 1907076
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 9BBg4OU17uWLXUW0dhSs0wLARvuiL5fHWqyMBlS6hmgW5c_ryMFAng==

GET
H3

200

dcmads.js Show response
www.googletagservices.com/dcm/ Frame 5F45
Redirect Chain

https://fw.adsafeprotected.com/rfw/www.googletagservices.com/1193990/66063503/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bg3.co%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9dd...
https://www.googletagservices.com/dcm/dcmads.js

28 KB
11 KB

168ms
168ms

Script
text/javascript

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

250686eb4f9e94b0bd0812e4e65b239b3355af85e21aff1dfaf3914f8b99f8f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 16:54:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1590
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10831
x-xss-protection: 0
last-modified: Wed, 21 Sep 2022 13:41:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Thu, 13 Oct 2022 17:54:22 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: app01.sg.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://www.googletagservices.com/dcm/dcmads.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 3F7B 91 KB
23 KB 1321ms
660ms Script
application/javascript 18.155.145.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.145.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-145-129.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 107d9675170d96f52a4921f960f44e7c.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-P1
age: 1907076
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: yvB0hq51nEWBPyiUfkb_0E-vclKdKqaC0ifGmwuXxXN1hzhVD5TtZw==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 1293ms
584ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=c07b1487-ffc3-0027-d04b-13e18e1489e6&tv=%7Bc:qWFPSV,pingTime:-3,time:96,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:96,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B89~0%5D,as:%5B89~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C17*.1193990-66063505%7C171%7C172%7C181%7C182%7C19%7C1a,idMap:17*,rmeas:1,rend:0,renddet:IMG.us,siq:23%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 998ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=c07b1487-ffc3-0027-d04b-13e18e1489e6&tv=%7Bc:qWFPSX,pingTime:-6,time:98,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:98,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B91~0%5D,as:%5B91~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C17*.1193990-66063505%7C171%7C172%7C181%7C182%7C19%7C1a,idMap:17*,rmeas:1,rend:0,renddet:IMG.us,siq:23%7D&tpiLookup=ao:www.bg3.co*&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 993ms
292ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=bec59399-84d1-ed6a-fb82-930da26a5b4b&tv=%7Bc:qWFPT3,pingTime:-3,time:55,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:55,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B49~0%5D,as:%5B49~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.1193990-66063503%7C161%7C162%7C17.1193990-66063505%7C171%7C172%7C173%7C181%7C182%7C19%7C1a,idMap:16*,rmeas:1,rend:0,renddet:IMG.us,siq:22%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 1283ms
585ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=bec59399-84d1-ed6a-fb82-930da26a5b4b&tv=%7Bc:qWFPT4,pingTime:-6,time:56,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:56,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B50~0%5D,as:%5B50~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.1193990-66063503%7C161%7C162%7C17.1193990-66063505%7C171%7C172%7C173%7C181%7C182%7C19%7C1a,idMap:16*,rmeas:1,rend:0,renddet:IMG.us,siq:22%7D&tpiLookup=ao:www.bg3.co*&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 1276ms
585ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=c07b1487-ffc3-0027-d04b-13e18e1489e6&tv=%7Bc:qWFPTd,pingTime:-2,time:114,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:527,mdZ:1716,beA:1720,beZ:1722,mfA:1724,cmA:1725,inA:1725,inZ:1729,prA:1729,prZ:1736,si:1742,poA:1743,poZ:1765,cmZ:1765,mfZ:1765,loA:1817,loZ:1820,ltA:1834,ltZ:1834%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:114,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B107~0%5D,as:%5B107~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16.1193990-66063503%7C161%7C162%7C17*.1193990-66063505%7C171%7C172%7C181%7C182%7C19%7C1a,idMap:17*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:23,sinceFw:90,readyFired:false%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6A4F 42 B
64 B 174ms
174ms Fetch
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst2_csdVpxx2tjahRUD0cNpDeepzEj7vo0FGUnwGDTvR7k63BF7KUzjHGuKVBEQZp5ltPoVhxJILIXY_8NyIShs3CHT&sig=Cg0ArKJSzLwHL_4c01YBEAE&cid=CAASFeRoM241Nwy902QiwdmTGksx2N55xw&id=lidar2&mcvt=1014&p=300,5,900,125&mtos=1014,1014,1014,1014,1014&tos=1014,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4082231052&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665681650205&rpt=804&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 1270ms
583ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=bec59399-84d1-ed6a-fb82-930da26a5b4b&tv=%7Bc:qWFPTi,pingTime:-2,time:70,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:512,mdZ:1726,beA:1779,beZ:1780,mfA:1782,cmA:1783,inA:1783,inZ:1787,prA:1787,prZ:1794,si:1800,poA:1801,poZ:1822,cmZ:1822,mfZ:1822,loA:1835,loZ:1838,ltA:1848,ltZ:1848%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:70,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B64~0%5D,as:%5B64~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.1193990-66063503%7C161%7C162%7C17.1193990-66063505%7C171%7C172%7C173%7C181%7C182%7C19%7C1a,idMap:16*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:22,sinceFw:47,readyFired:false%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 all
csm.as.criteo.net/ Frame 4BD3 0
127 B 171ms
171ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 13 Oct 2022 17:20:52 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame DC80 428 B
554 B 172ms
172ms Fetch
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertag&domain=bg3.co&sn=ChromeSyncframe&so=0&topUrl=www.bg3.co&cw=1&lsw=1&topicsavail=0&fledgeavail=0

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.bg3.co

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

ffdad1dc1e2a12b6912ecc725da9c42ae9661d03796cb04cf894d0ded78726c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.bg3.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1662103
expires: 0

GET
H3 200 impl_v91.js Show response
www.googletagservices.com/dcm/ Frame 1C44 61 KB
23 KB 169ms
169ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v91.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/www.googletagservices.com/1193990/66063505/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bg3.co%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:c07b1487-ffc3-0027-d04b-13e18e1489e6,c:qWFPRI,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5b77d768f7-lfjzb,rg:sg,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,dvs:visible,oam:0,mtim:4,mot:0,app:0,maw:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C17*.1193990-66063505%7C171%7C172%7C181%7C182%7C19%7C1a,idMap:17*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:22,oid:62dd1705-4b1b-11ed-add2-fae7f7e723d5,v:19.8.355,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bfcf80bfb2d17562d38d3f50db9274d902ec50021beb3cc46ca61de7d2410a2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 20:53:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 505668
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23646
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:32:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Oct 2023 20:53:04 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
216 B 694ms
291ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=c07b1487-ffc3-0027-d04b-13e18e1489e6&tv=%7Bc:qWFPXR,time:402,type:e,im:%7Bimprf:%7Bttecl:1569,ecd:347,tsecr:6%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:402,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B395~0%5D,as:%5B395~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16.1193990-66063503%7C161%7C162%7C17*.1193990-66063505%7C171%7C172%7C181%7C182%7C19%7C1a,idMap:17*,rmeas:1,rend:0,renddet:IMG.us,siq:23,sis:376%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 impl_v91.js Show response
www.googletagservices.com/dcm/ Frame 5F45 61 KB
23 KB 169ms
169ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v91.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/www.googletagservices.com/1193990/66063503/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bg3.co%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:bec59399-84d1-ed6a-fb82-930da26a5b4b,c:qWFPSu,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5b77d768f7-xp42v,rg:sg,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:2,mot:0,app:0,maw:0,fm:tkaisEi+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.1193990-66063503%7C161%7C162%7C171%7C172%7C173%7C181%7C182%7C19%7C1a,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:21,oid:62dd1760-4b1b-11ed-b659-da3a06bd8f65,v:19.8.355,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bfcf80bfb2d17562d38d3f50db9274d902ec50021beb3cc46ca61de7d2410a2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 20:53:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 505668
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23646
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:32:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Oct 2023 20:53:04 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 648ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=bec59399-84d1-ed6a-fb82-930da26a5b4b&tv=%7Bc:qWFPYD,time:402,type:e,im:%7Bimprf:%7Bttecl:1641,ecd:348,tsecr:4%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:402,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B396~0%5D,as:%5B396~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.1193990-66063503%7C161%7C162%7C17.1193990-66063505%7C171%7C172%7C173%7C181%7C182%7C19%7C1a,idMap:16*,rmeas:1,rend:0,renddet:IMG.us,siq:22,sis:374%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 B27780266.347603910;dc_ver=91.268;sz=728x90;u_sd=1;dc_adk=3047537733;ord=0ugq2p;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXC_H8UhIY_LjLZCKvwTThr2oCsqnrvBs1_KbjM0Q... Show response
ad.doubleclick.net/ddm/adj/N35502.3574589MIQDIGITAL/ Frame 1C44 67 KB
29 KB 549ms
209ms Script
text/javascript 142.251.10.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N35502.3574589MIQDIGITAL/B27780266.347603910;dc_ver=91.268;sz=728x90;u_sd=1;dc_adk=3047537733;ord=0ugq2p;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXC_H8UhIY_LjLZCKvwTThr2oCsqnrvBs1_KbjM0Q3MWRxYw1EAEguoTAM2ClwKOApAGgAYj5ivMoyAEJqQKGbyuXgxylPqgDAaoE1gFP0J9xGrY732MaS98sW9dCZDMf1Ne8LG1Lt0jzci6gMcLCiP247KPq6i1E7fkY26LYeZ1sJIgHXca9Ek1mog3VSo_DWmXb2Qd2M3v0mo_6ysAGPZx7TBPB-rOKXNstuoHtB026njzrYG6Jo_MY6Mcl72_rsSReGlW_ZyoCQGXBOxlDJyRTkniuzU0bM7EW25kMEC5AM_kACAJAcPOA0dyufMl2VBsPw5EfOm9qnvuCUh1H7s_fH-bv3eQQiMJDIUVVYRoKYbmQ4C6Krb2PL-b9krMipvSTwATA-YfBkwTgBAOQBgGgBk2AB4ix29IDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIDwiAYRABGB0yAooCOgKAQPIIG2FkeC1zdWJzeW4tNTIzOTkzODIxMzg3MDM4MIAKA5gLAcgLAYAMAbATyOXnENATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJeRoPhpJ0uc6emOpZYOCHjqRiuSqRD10mNdd4XJRxq7dNfi7Wgo%26sig%3DAOD64_02J77FtKju5TCb70MR3lUt2OfzIg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-DRQNtLmODEcnAEsXDWEC_ktwLeSMB-M1zOS7bcAGxkIemc0Cw_yOVOwz9VIH5QwH2Aff83GI1NFejrVDzLfcaAaUljuMFptOUT-srC03gDQ7dGMOeyH700jTrlVowJMpoyJRMAqufCEK9eMy9iK7r2Ia7VUwjnbNrZM8zt-xpT2wRlP78%26cry%3D1%26dbm_d%3DAKAmf-CL1NhK0htrqEVMG1MGi1gZ_43F5IWyaZ1XjifDqe_BfLpi05j4w9B1g4KeJ-Pv24GcJlIzitkLL7reXAuFiH9_gKGkbTJGJhqK7FIe3-lQIxPkc4PjRMnb_aTXjCo03Uk76gPeISU4tBbQ33QZV5j3MWCkDeOK5zPq8bm0XrTs7lkQtz2Y0J4bcvxaT4CMcmz3n8oBM_QOcn19iQr_qhpk2x7jPyGZgcjNjff5BEwixspMeNmGti_JAb79IOcSFe5QZP3zJD2g9VbDj0lxcznkC-d08CUsf-P_t8sem93ja7ApIksRu1xu6fldiwnHmO7_mO8aSMBg48-ZpjRfrxyRvN_36f1pvCVYHEnEox7Ej9aSMpTBRde8Ug7XMFj7OXOJ1YozeEw-P1fyU8Bcmxg9RwX8WqY0dRUGhIDhT8pSNfllogvbABmHqZeJTVPBt_DFDOfkTnPd7JM0mbRYKAHxoED658J1czBZhr3PTtPxJBMxk6NxI-qEOReBqO0Yoewpk5cQyRGfse2WA2wBsD72JUhNWdFLvWoK-659n84pe9Bgclkl97nPVCLJQlGH9Cged4FZ12K1eUewgk4ZJ4iZ9dgaeB_BfOfDlOSnQXPOSY-9Lozci-fAQhGv4G8dSnhVJQp7gPVHKYY2VGS7rwexhADK7g%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=-.aoFsUgFb;stc=1;chaa=1;sttr=189;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v91.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f148.1e100.net

Software

cafe /

Resource Hash

c670cb1a950a9a399e6f043d99969f4d46408c298db83a539b54ac275ef63e2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28968
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 B27780266.347603880;dc_ver=91.268;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=2228999113;ord=x8kktd;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DChXm38UhIY_HjLZCKvwTThr2... Show response
ad.doubleclick.net/ddm/adj/N35502.3574589MIQDIGITAL/ Frame 5F45 67 KB
28 KB 681ms
382ms Script
text/javascript 142.251.10.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N35502.3574589MIQDIGITAL/B27780266.347603880;dc_ver=91.268;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=2228999113;ord=x8kktd;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DChXm38UhIY_HjLZCKvwTThr2oCsqnrvBs7_SbjM0Q3MWRxYw1EAEguoTAM2ClwKOApAGgAYj5ivMoyAEJqQKGbyuXgxylPqgDAaoE1AFP0DjlR2v3I1H2C0jGIM8bMoWN1KuP4Im7c0FCovVZ9lSw4ly8TSkhMoWjK-9r92SfSV_wOQEf723nrtx7Nu4bkSAsGNTLKIQY_wb6faMwS_W_o-a2AW67ABCDQTGicaEpTlS4WmHXgmxuEMRrkSOJuKzNVuakTE-_dJIS6fSB9x-a_oqFevfXJyl6Oah1G-lDeexAghLAqpyF79UVT9SC1fbjB3Ca5TUiGdDZ_f2Ylh3_JAAWi5_LT3UPIqvOFfKbtf4MVzk_mz5EzCqrts3kV2algMAEwPmHwZME4AQDkAYBoAZNgAeIsdvSA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE8jl5xDQEwDYEw3YFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJeRoZqdY8NualZ4IFFxajYcnzvtrbSnLv5ag-nqLdBTXPg3wPDU%26sig%3DAOD64_1t_TmHafFBVcEvdDhYqjZywPK3ow%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-DUijBXTKZSbnoJ8dgKAMBHe2S9pgay12MAsAOL39nLWCXVM_qCrLtwYQli8DHaIfvBFmiSnRgDnb_ZO9gFLk7dJTUqRw2wi5IOnfp2r-Y1fsX7xBiRmoqJtkjS_IuirJgajrUahsD2WhkCFCqbZ2DWxZvrUADK9EB0F8_E8nJ8sgPnOng%26cry%3D1%26dbm_d%3DAKAmf-DhtwvVZfsYRUaZ5p7qWGDtD0l4IXYZlUmXMnii4nbfO57URJReRr5JqxOSKmxz5lomnpUl2hs6wiGcbW3BO3rTVf2he6RkVUqP8CrIAYZRAiisY3DOaS5Up46wa_DHdKkojuatIpbq8XR0tLR1w2NUb08xKdv6_yHKYgHwtXt_C8kiFqU1kPfYqevYKSLLPZObyeOitWzofZvzu_ieOjeTfDznAw1XGPi9LuhtqRC8G8uhVGCQh77S1EFl4TI-1kjRptXw9AfhgZTScACwPM3HJk3d_BnyoZB6OqzqRHpjrcJDIamHqekluih3ktRKxEOlh2-QwrqqHsNP3eJyAPvozBJSGfP6_dmoMUXaYtOaaaYoRv8c0RlQQcZRIhtA233kr816BeQh2IeZPMxlAbd2rgsflELjlpwlMXQep_ghN35QyyzBZfxElCS4bztbLkoHdr9aIpz8-IcxBcZpdSZIq4OhUj548bBorXrtiZZwXBuETOwUJH0kcPpMSt7qjFEAfZWXicfR43mYEXiR2ds9fnrDBJcsxMqzS9-8Ojb2vV_NiiBEp6VUAF6ofbAbctmP6cHWU7z8XDX6hQpNgNjUgsYBOQQ_U_-KcTkR2pshLgp0BFKhWF1P6bQ0l19dnFXNy-CugAewSRr-nN7eYV03MyjhLw%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=-.aoFsUgFb;stc=1;chaa=1;sttr=185;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v91.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f148.1e100.net

Software

cafe /

Resource Hash

3c64cbfe8bfa3da878054e6117e7a9fac6a0b4d81dae646ca4fd9462da5a0cde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28971
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 507ms
169ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bg3.co
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 13 Oct 2022 17:20:52 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 268645
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ 418 B
708 B 174ms
174ms XHR
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

028cf12cc4e713a9e0c80cf5e25c45f022c66156f9090e7b1848fe80d4ad22b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2820461
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
541 B 297ms
98ms XHR
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 97d325175de8c9a7ee494534c251adb01374e6e440ab76e71cd44360f0dcc383

Request headers

Referer: https://www.bg3.co/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 13 Oct 2022 17:20:52 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Sat, 12 Nov 2022 17:20:53 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 4A33 4 KB
2 KB 498ms
328ms Document
text/html 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1665681649225

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Resource Hash

adee4657c8be55e46486a118975677075544c6350ef880cff90cdd776f938598

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1373
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame B363 9 KB
4 KB 1322ms
427ms Document
text/html 52.84.45.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-7.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7efdca1ce8a8ee4fb50887d9f88bdace1026e0f76ea1e64a802b97402d825a79

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 39206
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Thu, 13 Oct 2022 07:43:52 GMT
etag: W/"3b058e9cd661ca6990301a82cf5d448f"
last-modified: Wed, 17 Aug 2022 23:23:08 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 0b2f0b4cff86a910cb2f7990385ac516.cloudfront.net (CloudFront)
x-amz-cf-id: kysTc0Zn2eHYBebggKr0qx0CufjQNWjGX2ILy1vjXjie4p_srDcqyA==
x-amz-cf-pop: MRS52-P1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:049b4e88-3480-44ce-bc71-9207efe847a1
x-amz-meta-codebuild-content-md5: 77e8f986028c7819a018b65a51e4d1c5
x-amz-meta-codebuild-content-sha256: 4cf0411e60b9185dacd3ae0196e3adabe45eed1b64ea27e89ed58c43c33d4297
x-cache: Hit from cloudfront

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 59F0 1 KB
1 KB 189ms
189ms Document
text/html 52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: a3d9f6689afc4f82e21270d031036321dce3ed8c9835b3adbeb05623d25fdf1a

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 457
content-type: text/html; charset=utf-8
date: Thu, 13 Oct 2022 17:20:52 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame 1095 533 B
635 B 183ms
177ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 21b287263ed9228790260bd31315a51f4206f272de240900aa69e7f54cc5aab6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 323
content-type: text/html
date: Thu, 13 Oct 2022 17:20:52 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame B486 281 B
554 B 1001ms
321ms Document
text/html 184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 13 Oct 2022 17:20:53 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame FCF5 52 KB
17 KB 1325ms
350ms Document
text/html 104.65.228.195
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.228.195 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-228-195.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 13 Oct 2022 17:20:53 GMT
ETag: "623de86a-cf34"
Expires: Fri, 14 Oct 2022 17:20:55 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame 49DB 3 KB
2 KB 1279ms
318ms Document
text/html 104.65.229.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.2 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-2.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1387
Content-Type: text/html; charset=UTF-8
Date: Thu, 13 Oct 2022 17:20:53 GMT
ETag: "e20015-b68-5e4a60c97afb7"
Last-Modified: Mon, 25 Jul 2022 19:18:30 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server: Apache
Vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 24C6 36 KB
12 KB 651ms
195ms Document
text/html 23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

11e82ca2aef96b54c71ec4946b2d56dbf7a30de4cc233fea920996796bc4b4d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11836
content-type: text/html; charset=UTF-8
date: Thu, 13 Oct 2022 17:20:53 GMT
expires: Sat, 15 Oct 2022 17:20:53 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2

204

yahoo
prebid.a-mo.net/setuid/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=dd94df2c-8e1a-4ea6-a974-f32605671c7b
https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=dd94df2c-8e1a-4ea6-a974-f32605671c7b&verify=true
https://prebid.a-mo.net/setuid/yahoo?uid=y-zYaalE9E2uGAwEH74IBs3F7CKq7d.a1fBWvAhO0-~A&gdpr=0&gdpr_consent=

0
112 B

313ms
312ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-zYaalE9E2uGAwEH74IBs3F7CKq7d.a1fBWvAhO0-~A&gdpr=0&gdpr_consent=
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:52 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-zYaalE9E2uGAwEH74IBs3F7CKq7d.a1fBWvAhO0-~A&gdpr=0&gdpr_consent=
date: Thu, 13 Oct 2022 17:20:53 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

ImgSync
image8.pubmatic.com/AdServer/
Redirect Chain

https://prebid.a-mo.net/cchain?cb=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Damx%26uid%3Ddd94df2c-8e1a-4ea6-a974-f32605671c7b&gdpr=0&gdpr_consent=&us_privacy=1---
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....

0
42 B

580ms
189ms

Image
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fcchain%252F1%252F3271%253Fgdpr%253D0%2526gdpr_consent%253D%2526us_privacy%253D1---%2526A%253Ddd94df2c-8e1a-4ea6-a974-f32605671c7b%2526bidder%253Dpubmatic%2526cbx%253DaHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaWRkZXI9YW14JnVpZD1kZDk0ZGYyYy04ZTFhLTRlYTYtYTk3NC1mMzI2MDU2NzFjN2I%25253D%2526uid%253D%2523PMUID
Protocol: H2
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
content-length: 0

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=1&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fcchain%252F1%252F3271%253Fgdpr%253D0%2526gdpr_consent%253D%2526us_privacy%253D1---%2526A%253Ddd94df2c-8e1a-4ea6-a974-f32605671c7b%2526bidder%253Dpubmatic%2526cbx%253DaHR0cHM6Ly9pYi5hZG54cy5jb20vcHJlYmlkL3NldHVpZD9iaWRkZXI9YW14JnVpZD1kZDk0ZGYyYy04ZTFhLTRlYTYtYTk3NC1mMzI2MDU2NzFjN2I%25253D%2526uid%253D%2523PMUID
date: Thu, 13 Oct 2022 17:20:52 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

204

magnite
prebid.a-mo.net/setuid/
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=1---
https://prebid.a-mo.net/setuid/magnite?uid=L97BUHYP-E-E5FX&gdpr=0&us_privacy=1---

0
124 B

313ms
312ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=L97BUHYP-E-E5FX&gdpr=0&us_privacy=1---
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:52 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=L97BUHYP-E-E5FX&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
Expires: 0

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=dd94df2c-8e1a-4ea6-a974-f32605671c7b&gdpr=0&gdpr_consent=&us_privacy=1---
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=51156692-b53f-4d50-a156-5b806a4b8444&ssp=adaptmx&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10521886487891375067&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10521886487891375067&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=6596908a-1d49-48f2-a3b7-f80a06dcf3ed&ssp=adaptmx&gdpr_consent=&gdpr=0
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10521886487891375067&ssp=adaptmx&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=231983304303011507567&ssp=adaptmx&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10521886487891375067&ssp=adaptmx&gdpr=0&gdpr_consent=
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=$%20%20{UUID}&gdpr=0&gdpr_consent=&us_privacy=

0
141 B

315ms
314ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=$%20%20{UUID}&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Location: //prebid.a-mo.net/setuid?bidder=bid_switch&uid=$ {UUID}&gdpr=0&gdpr_consent=&us_privacy=
Date: Thu, 13 Oct 2022 17:20:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 1095
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4002404486759631747&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

175ms
175ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4002404486759631747&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4002404486759631747&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1095
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=cf31de19-0898-76ca-d057-ac4669418181&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=cf31de19-0898-76ca-d057-ac4669418181&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=f21a9cbf-768a-480f-9ab5-bebb15d45c42&ttd_puid=cf31de19-0898-76ca-d057-ac4669418181&gdpr=0&gdpr_consent=

43 B
249 B

177ms
177ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=f21a9cbf-768a-480f-9ab5-bebb15d45c42&ttd_puid=cf31de19-0898-76ca-d057-ac4669418181&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=f21a9cbf-768a-480f-9ab5-bebb15d45c42&ttd_puid=cf31de19-0898-76ca-d057-ac4669418181&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 1095
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y0hI9cCo5uYAAFRiLpMAAAAA

43 B
106 B

178ms
175ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y0hI9cCo5uYAAFRiLpMAAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 37
Date: Thu, 13 Oct 2022 17:20:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":37,"gdpr":false,"ipv4":"103.209.254.101","key":"Y0hI9cCo5uYAAFRiLpMAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad6"}
X-SO-Key: Y0hI9cCo5uYAAFRiLpMAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad6
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y0hI9cCo5uYAAFRiLpMAAAAA
Cache-Control: private
X-SO-HostName: m-ad6.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 2
Content-Length: 0
X-SO-LB-Hostname: a-tgng40015.dc2p.scaleout.jp
X-SO-IP: 103.209.254.101

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 1095
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AW_0-FOnAogrks8ADv_jAUV5Hs8AAAGD0lz_Sw

43 B
106 B

174ms
174ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AW_0-FOnAogrks8ADv_jAUV5Hs8AAAGD0lz_Sw
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 b0fefe61f56a8633f9022434d425989c.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SIN2-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AW_0-FOnAogrks8ADv_jAUV5Hs8AAAGD0lz_Sw
cache-control: no-cache
content-length: 0
x-amz-cf-id: ig27xh8QCs1Fon_3dJ5nUiVMlh0LVzsGAM10UcAb_yhuUz2DamDvAg==
expires: -1

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 1095 170 B
188 B 176ms
175ms Image
image/png 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZTM1ZTBkZDMtYzFlZi0yODZlLWM1YjctZjZmZmEzYTM0ZmUx

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1095
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJlD7V9qjbU8kAziiPYySnI&google_cver=1

43 B
122 B

175ms
172ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJlD7V9qjbU8kAziiPYySnI&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJlD7V9qjbU8kAziiPYySnI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 59F0
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=e4975f9d-6af1-4332-8a0f-f48771004dc1&dongle=0cfd

37 B
353 B

189ms
189ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=e4975f9d-6af1-4332-8a0f-f48771004dc1&dongle=0cfd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 13 Oct 2022 17:20:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=e4975f9d-6af1-4332-8a0f-f48771004dc1&dongle=0cfd
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 209

GET
H2

200

ebda
eb2.3lift.com/ Frame 59F0
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Njk5MDc3MjEyMDIwMDI0OTQwMjcy
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

188ms
188ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 59F0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEK8N590nSf0rlnbKiK8BYW0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
353 B

190ms
190ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEK8N590nSf0rlnbKiK8BYW0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 13 Oct 2022 17:20:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEK8N590nSf0rlnbKiK8BYW0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 59F0
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Njk5MDc3MjEyMDIwMDI0OTQwMjcy

170 B
188 B

176ms
175ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Njk5MDc3MjEyMDIwMDI0OTQwMjcy

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=Njk5MDc3MjEyMDIwMDI0OTQwMjcy
date: Thu, 13 Oct 2022 17:20:52 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
p.adsymptotic.com/d/px/ Frame 59F0
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=699077212020024940272&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=699077212020024940272&dbredirect=true&gdpr=0&consent=&cookiesTest=true
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=675974ec-458c-4dee-a952-ab5bcb6d5ac2&_noobservation=1
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=675974ec-458c-4dee-a952-ab5bcb6d5ac2&_noobservation=1&_expected_cookie=aeb075e...

43 B
164 B

185ms
183ms

Image
image/gif

104.18.98.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=675974ec-458c-4dee-a952-ab5bcb6d5ac2&_noobservation=1&_expected_cookie=aeb075e39624ed04c310e20b7835813d
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 104.18.98.194 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP='NON DSP COR CONi OUR BUS CNT'
date: Thu, 13 Oct 2022 17:20:54 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7599bfa149e55ac8-MEL
content-length: 43
content-type: image/gif

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=675974ec-458c-4dee-a952-ab5bcb6d5ac2&_noobservation=1&_expected_cookie=aeb075e39624ed04c310e20b7835813d
date: Thu, 13 Oct 2022 17:20:53 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7599bfa0292d5ac8-MEL
content-length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame 59F0
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=699077212020024940272&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=triplelift
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=triplelift
https://x.bidswitch.net/sync?dsp_id=70&user_id=6712601349632672716&ssp=triplelift
https://eb2.3lift.com/xuid?mid=2409&xuid=51156692-b53f-4d50-a156-5b806a4b8444&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
353 B

192ms
191ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=51156692-b53f-4d50-a156-5b806a4b8444&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 13 Oct 2022 17:20:54 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: //eb2.3lift.com/xuid?mid=2409&xuid=51156692-b53f-4d50-a156-5b806a4b8444&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date: Thu, 13 Oct 2022 17:20:53 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame 59F0
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/699077212020024940272?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-mBp6m19E2oSkgKbHQtAgUPyGJoOqnDzkpL3tMgrp0A--~A&dongle=0883

37 B
353 B

191ms
190ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mBp6m19E2oSkgKbHQtAgUPyGJoOqnDzkpL3tMgrp0A--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 13 Oct 2022 17:20:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Thu, 13 Oct 2022 17:20:53 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-mBp6m19E2oSkgKbHQtAgUPyGJoOqnDzkpL3tMgrp0A--~A&dongle=0883
content-length: 0

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 59F0
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=699077212020024940272
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=699077212020024940272&dcc=t

0
0

315ms
314ms

Image
text/html

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=699077212020024940272&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: HTTP/1.1
Server: 52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:53 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JWZYF4SCPZ29WXKM4B4F
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=699077212020024940272&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 c.gif
c.bing.com/ Frame 59F0 42 B
668 B 423ms
238ms Image
image/gif 13.107.21.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=699077212020024940272&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:52 GMT
last-modified: Tue, 13 Sep 2022 03:22:00 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AC79914927714B319650F4FE5CC24652 Ref B: MEL01EDGE1506 Ref C: 2022-10-13T17:20:53Z
etag: "8766f3fc1fc7d81:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame 59F0
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
https://stags.bluekai.com/site/23178?id=1GW7KOa8h2xsOMA8UhpQ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5GFDVON2LJ5QTQ...
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=1GW7KOa8h2xsOMA8UhpQ

37 B
353 B

190ms
190ms

Image
image/gif

52.223.2.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=1GW7KOa8h2xsOMA8UhpQ
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.2.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 13 Oct 2022 17:20:54 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Content-Type: text/html; charset=utf-8
Location: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=1GW7KOa8h2xsOMA8UhpQ
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 115
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 4A33
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=82596348-48f5-4a00-a860-fc2ff5254b1a&gdpr=1&gdpr_consent=

0
340 B

330ms
327ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=82596348-48f5-4a00-a860-fc2ff5254b1a&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Thu, 13 Oct 2022 17:20:53 GMT
Server: MT3 4539 98cc2da master hkg-pixel-x4 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=82596348-48f5-4a00-a860-fc2ff5254b1a&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 13 Oct 2022 17:20:52 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 4A33 0
239 B 1670ms
415ms Image
image/gif 69.173.144.139

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 4A33
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=8445328433425422172

0
340 B

327ms
327ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=8445328433425422172

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:53 GMT
AN-X-Request-Uuid: 4353a8ac-ac80-4daa-a69d-6ca2dcfe3f82
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=8445328433425422172
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 4A33 42 B
678 B 370ms
170ms Image
image/gif 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=3hIkr--sabpVlITi7FfabXGJ_iuZKiIrJVhM69Q60B8
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4A33
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABg9Jc_il-dyG6oe6sBjFTs5w_TY-6ifsyvA

170 B
188 B

174ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABg9Jc_il-dyG6oe6sBjFTs5w_TY-6ifsyvA

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABg9Jc_il-dyG6oe6sBjFTs5w_TY-6ifsyvA
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ Frame 4A33 0
45 B 599ms
169ms Image
text/plain 23.106.127.52
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.52 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 4A33
Redirect Chain

https://id.rlcdn.com/711916.gif?ct=4&cv=
https://id.rlcdn.com/1000.gif?memo=COy5KxoNCPWRoZoGEgUI6AcQAEIASgA
https://onetag-sys.com/match/?int_id=110&uid=

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=110&uid=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://onetag-sys.com/match/?int_id=110&uid=
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 4A33
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=mBsGxzC2fVPwwbXS1_6_Mz7oOA9uAKWG6MF6o4PPmPE

43 B
479 B

756ms
295ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=mBsGxzC2fVPwwbXS1_6_Mz7oOA9uAKWG6MF6o4PPmPE

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 62JR1VK7Y37DWYR63GHT
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=mBsGxzC2fVPwwbXS1_6_Mz7oOA9uAKWG6MF6o4PPmPE
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 4A33 0
39 B 363ms
189ms Image
text/plain 103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 4A33
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESELsqXW36BaquXgc6kwNRL1c&google_cver=1

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESELsqXW36BaquXgc6kwNRL1c&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-52-74-162-2.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESELsqXW36BaquXgc6kwNRL1c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame 4A33 0
15 B 184ms
181ms Image
text/plain 52.74.162.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.74.162.2 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 4A33
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=

0
340 B

328ms
327ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/match/?int_id=29&uid=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 4A33 43 B
235 B 220ms
219ms Image
image/gif 35.213.12.39
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1665681649225
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.12.39 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 39.12.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:53 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 1C44 106 KB
37 KB 527ms
182ms Script
text/javascript 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Origin: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 20:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 13 Oct 2022 20:03:41 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/ Frame 1C44 8 KB
3 KB 169ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N35502.3574589MIQDIGITAL/B27780266.347603910;dc_ver=91.268;sz=728x90;u_sd=1;dc_adk=3047537733;ord=0ugq2p;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXC_H8UhIY_LjLZCKvwTThr2oCsqnrvBs1_KbjM0Q3MWRxYw1EAEguoTAM2ClwKOApAGgAYj5ivMoyAEJqQKGbyuXgxylPqgDAaoE1gFP0J9xGrY732MaS98sW9dCZDMf1Ne8LG1Lt0jzci6gMcLCiP247KPq6i1E7fkY26LYeZ1sJIgHXca9Ek1mog3VSo_DWmXb2Qd2M3v0mo_6ysAGPZx7TBPB-rOKXNstuoHtB026njzrYG6Jo_MY6Mcl72_rsSReGlW_ZyoCQGXBOxlDJyRTkniuzU0bM7EW25kMEC5AM_kACAJAcPOA0dyufMl2VBsPw5EfOm9qnvuCUh1H7s_fH-bv3eQQiMJDIUVVYRoKYbmQ4C6Krb2PL-b9krMipvSTwATA-YfBkwTgBAOQBgGgBk2AB4ix29IDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIDwiAYRABGB0yAooCOgKAQPIIG2FkeC1zdWJzeW4tNTIzOTkzODIxMzg3MDM4MIAKA5gLAcgLAYAMAbATyOXnENATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJeRoPhpJ0uc6emOpZYOCHjqRiuSqRD10mNdd4XJRxq7dNfi7Wgo%26sig%3DAOD64_02J77FtKju5TCb70MR3lUt2OfzIg%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-DRQNtLmODEcnAEsXDWEC_ktwLeSMB-M1zOS7bcAGxkIemc0Cw_yOVOwz9VIH5QwH2Aff83GI1NFejrVDzLfcaAaUljuMFptOUT-srC03gDQ7dGMOeyH700jTrlVowJMpoyJRMAqufCEK9eMy9iK7r2Ia7VUwjnbNrZM8zt-xpT2wRlP78%26cry%3D1%26dbm_d%3DAKAmf-CL1NhK0htrqEVMG1MGi1gZ_43F5IWyaZ1XjifDqe_BfLpi05j4w9B1g4KeJ-Pv24GcJlIzitkLL7reXAuFiH9_gKGkbTJGJhqK7FIe3-lQIxPkc4PjRMnb_aTXjCo03Uk76gPeISU4tBbQ33QZV5j3MWCkDeOK5zPq8bm0XrTs7lkQtz2Y0J4bcvxaT4CMcmz3n8oBM_QOcn19iQr_qhpk2x7jPyGZgcjNjff5BEwixspMeNmGti_JAb79IOcSFe5QZP3zJD2g9VbDj0lxcznkC-d08CUsf-P_t8sem93ja7ApIksRu1xu6fldiwnHmO7_mO8aSMBg48-ZpjRfrxyRvN_36f1pvCVYHEnEox7Ej9aSMpTBRde8Ug7XMFj7OXOJ1YozeEw-P1fyU8Bcmxg9RwX8WqY0dRUGhIDhT8pSNfllogvbABmHqZeJTVPBt_DFDOfkTnPd7JM0mbRYKAHxoED658J1czBZhr3PTtPxJBMxk6NxI-qEOReBqO0Yoewpk5cQyRGfse2WA2wBsD72JUhNWdFLvWoK-659n84pe9Bgclkl97nPVCLJQlGH9Cged4FZ12K1eUewgk4ZJ4iZ9dgaeB_BfOfDlOSnQXPOSY-9Lozci-fAQhGv4G8dSnhVJQp7gPVHKYY2VGS7rwexhADK7g%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=-.aoFsUgFb;stc=1;chaa=1;sttr=189;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80942
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 26 Oct 2022 18:51:51 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C490 22 KB
8 KB 171ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 567017
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 07 Oct 2022 03:50:36 GMT
expires: Sat, 07 Oct 2023 03:50:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 main.19.8.355.js Show response
static.adsafeprotected.com/ Frame 1C44 194 KB
60 KB 388ms
383ms Script
application/javascript 18.155.145.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.355.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10933&advId=1008917700&campId=18563143810&pubId=1&chanId=881479034793&placementId=445252796&dealId=&adsafe_par&impId=ABAjH0igJ7x1lTujPDYebt31MnHw&bidurl=https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.145.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-145-129.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 81e5cc1058a8711411ee3244831936a088543cbd86b5eaa579e258d9c456e8b1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:12:46 GMT
x-amz-version-id: Os.8EiheWKF00Q0a8Kg0Ad0ou3MT9I_t
content-encoding: gzip
via: 1.1 107d9675170d96f52a4921f960f44e7c.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-P1
age: 612488
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 06 Oct 2022 10:37:53 GMT
server: AmazonS3
etag: W/"739a5ec7d51544e57ec8eba795c7ad5e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: uUeTwLV-mM1mtY1SS_9eSYSP8qCeLwbJ4LqgPihh7FISiUNL7ZIbUw==

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D48C 1 KB
648 B 169ms
168ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 56751
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 01:35:02 GMT
etag: 48472445140208031
expires: Fri, 14 Oct 2022 01:35:02 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 1C44 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a99a25b23486043d5e436c85c00950759950a8a980776ccdfc71d797f8d2d11

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sync Show response
gum.criteo.com/ Frame 24C6 88 B
344 B 172ms
172ms Script
text/javascript 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e30f668c038686ec08de2e8678e518aad62653ba9305bbeb505b16e2a7bfd74e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1082342
expires: 60

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame E4F5
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
https://eus.rubiconproject.com/usync.html?p=medianet

281 B
554 B

318ms
317ms

Document
text/html

184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=medianet
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 13 Oct 2022 17:20:54 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 13 Oct 2022 17:20:54 GMT
location: https://eus.rubiconproject.com/usync.html?p=medianet
server: AkamaiGHost

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame 9555
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Drkt%26refUrl%3D%26vid%3D568165328930868325315397280...
https://contextual.media.net/cksync.html?cs=8&vsid=3086832531539728000V10&type=rkt&refUrl=&vid=56816532893086832531539728000V10&ovsid=1973209965703780618

219 B
651 B

217ms
217ms

Document
text/html

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3086832531539728000V10&type=rkt&refUrl=&vid=56816532893086832531539728000V10&ovsid=1973209965703780618

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 219
content-type: text/html;charset=UTF-8
date: Thu, 13 Oct 2022 17:20:54 GMT
expires: Thu, 13 Oct 2022 17:20:54 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Thu, 13 Oct 2022 17:20:54 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3086832531539728000V10&type=rkt&refUrl=&vid=56816532893086832531539728000V10&ovsid=1973209965703780618
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C963 15 KB
6 KB 968ms
317ms Document
text/html 104.65.228.208

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.228.208 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=39163
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 13 Oct 2022 17:20:54 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 14 Oct 2022 04:13:37 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cksync.php
contextual.media.net/ Frame 24C6
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dapx%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3D%24UID
https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=apx&refUrl=&vid=56816532893086832531539728000V10&ovsid=8445328433425422172

45 B
452 B

203ms
203ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=apx&refUrl=&vid=56816532893086832531539728000V10&ovsid=8445328433425422172

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:53 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:53 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:53 GMT
AN-X-Request-Uuid: 90a8d557-609b-4128-b64f-020aac2a3b2b
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=apx&refUrl=&vid=56816532893086832531539728000V10&ovsid=8445328433425422172
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cksync.html
contextual.media.net/ Frame 24C6
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3086832531539728...
https://contextual.media.net/cksync.html?cs=8&vsid=3086832531539728000V10&type=opx&refUrl=&vid=56816532893086832531539728000V10&ovsid=071db786-a398-4c2a-b318-d228dbae135d

219 B
219 B

224ms
224ms

Image
text/html

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3086832531539728000V10&type=opx&refUrl=&vid=56816532893086832531539728000V10&ovsid=071db786-a398-4c2a-b318-d228dbae135d

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:53 GMT
server: Apache
vary: Accept-Encoding
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: text/html;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 219
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:53 GMT

Redirect headers

date: Thu, 13 Oct 2022 17:20:53 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://contextual.media.net/cksync.html?cs=8&vsid=3086832531539728000V10&type=opx&refUrl=&vid=56816532893086832531539728000V10&ovsid=071db786-a398-4c2a-b318-d228dbae135d
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 24C6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dmma%26refUrl%3D%26vid%3D568165328930868325315397...
https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=mma&refUrl=&vid=56816532893086832531539728000V10&ovsid=f7876348-48f5-4e00-bc45-8c58c57453f1

45 B
466 B

218ms
218ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=mma&refUrl=&vid=56816532893086832531539728000V10&ovsid=f7876348-48f5-4e00-bc45-8c58c57453f1

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:54 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:54 GMT

Redirect headers

Date: Thu, 13 Oct 2022 17:20:53 GMT
Server: MT3 4539 98cc2da master hkg-pixel-x2 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=mma&refUrl=&vid=56816532893086832531539728000V10&ovsid=f7876348-48f5-4e00-bc45-8c58c57453f1
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 13 Oct 2022 17:20:52 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 24C6
Redirect Chain

https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dr1%26refUrl%3D%26vid%3D56816532893086832531...
https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&zcc=1&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dr1%26refUrl%3D%26vid%3D56816532893086...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6056848570
https://sync.1rx.io/usersync/tradedesk/e4975f9d-6af1-4332-8a0f-f48771004dc1
https://sync.targeting.unrulymedia.com/csync/RX-2123905e-4908-47d5-ab08-e35a997eea08-004?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-2123905e-4908-47d5-ab08-e35a997eea08-004
https://ads.servenobid.com/sync?pid=321&uid=RX-2123905e-4908-47d5-ab08-e35a997eea08-004

0
361 B

358ms
357ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=321&uid=RX-2123905e-4908-47d5-ab08-e35a997eea08-004
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=321&uid=RX-2123905e-4908-47d5-ab08-e35a997eea08-004
date: Thu, 13 Oct 2022 17:20:54 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX2123905e490847d5ab08e35a997eea08004
content-type: text/html

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 24C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzA4NjgzMjUzMTUzOTcyODAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEGxQq2nP5yzFNUMO9OTO4pM&google_cver=1

45 B
610 B

978ms
343ms

Image
image/gif

23.36.48.24

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEGxQq2nP5yzFNUMO9OTO4pM&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 23.36.48.24 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Thu, 13 Oct 2022 17:20:54 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEGxQq2nP5yzFNUMO9OTO4pM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 24C6
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Ddxu%26refUrl%3D%26vid%3D56816532893086832531539...
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Ddxu%26refUrl%3D%26vid%3D56816532893086832...
https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=dxu&refUrl=&vid=56816532893086832531539728000V10&ovsid=yLzCDavG1OJ1T75

45 B
452 B

228ms
228ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=dxu&refUrl=&vid=56816532893086832531539728000V10&ovsid=yLzCDavG1OJ1T75

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:54 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:54 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:53 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-062a250e8c9e3d8af@ap-southeast-1b@dxedge-app-ap-southeast-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=dxu&refUrl=&vid=56816532893086832531539728000V10&ovsid=yLzCDavG1OJ1T75
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 24C6 43 B
363 B 516ms
169ms Image
image/gif 182.161.73.146
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.146 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 292891
expires: Thu, 13 Oct 2022 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 24C6
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=51156692-b53f-4d50-a156-5b806a4b8444&ssp=medianet&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10521886487891375067&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=6596908a-1d49-48f2-a3b7-f80a06dcf3ed&ssp=medianet&gdpr_consent=&gdpr=0
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10521886487891375067&ssp=medianet&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=232743304303011502099&ssp=medianet&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10521886487891375067&ssp=medianet&gdpr=0&gdpr_consent=
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=0&gdpr_consent=&gdpr_pd=

45 B
465 B

195ms
194ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=0&gdpr_consent=&gdpr_pd=

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:55 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:55 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=0&gdpr_consent=&gdpr_pd=
Date: Thu, 13 Oct 2022 17:20:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 24C6
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dzem%26refUrl%3D%26vid%3D56816532893086832531539728...
https://stags.bluekai.com/site/23178?id=1GW7KOa8h2xsOMA8UhpQ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJRI5LTOS2PME4GQMTYONHU2QJYKVUHA...
https://contextual.media.net/cksync.php?cs=8&ovsid=1GW7KOa8h2xsOMA8UhpQ&refUrl=&type=zem&vid=56816532893086832531539728000V10&vsid=3086832531539728000V10

45 B
455 B

204ms
204ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&ovsid=1GW7KOa8h2xsOMA8UhpQ&refUrl=&type=zem&vid=56816532893086832531539728000V10&vsid=3086832531539728000V10

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:54 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:54 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=8&ovsid=1GW7KOa8h2xsOMA8UhpQ&refUrl=&type=zem&vid=56816532893086832531539728000V10&vsid=3086832531539728000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 196
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 24C6
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=3086832531539728000V10
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=medianet&ssp_user_id=3086832531539728000V10
https://contextual.media.net/cksync.php?type=mf&ovsid=49bd551d-dcea-49a9-837f-6cf9e9b7d1a2&cs=1

45 B
465 B

211ms
211ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=mf&ovsid=49bd551d-dcea-49a9-837f-6cf9e9b7d1a2&cs=1

Requested by

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:55 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:55 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?type=mf&ovsid=49bd551d-dcea-49a9-837f-6cf9e9b7d1a2&cs=1
Date: Thu, 13 Oct 2022 17:20:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 um
cs.emxdgt.com/ Frame 24C6 0
67 B 923ms
293ms Image
text/plain 3.215.244.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.emxdgt.com/um?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Demx%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3D%24UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.244.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-244-231.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
server: awselb/2.0
content-length: 0
content-type: text/plain; charset=utf-8

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 24C6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=e4975f9d-6af1-4332-8a0f-f48771004dc1

45 B
621 B

1035ms
361ms

Image
image/gif

23.36.48.24

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=e4975f9d-6af1-4332-8a0f-f48771004dc1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 23.36.48.24 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Thu, 13 Oct 2022 17:20:54 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=e4975f9d-6af1-4332-8a0f-f48771004dc1
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 5F45 106 KB
37 KB 400ms
172ms Script
text/javascript 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Origin: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 20:03:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 13 Oct 2022 20:03:41 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/ Frame 5F45 8 KB
3 KB 169ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221012/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N35502.3574589MIQDIGITAL/B27780266.347603880;dc_ver=91.268;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=2228999113;ord=x8kktd;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DChXm38UhIY_HjLZCKvwTThr2oCsqnrvBs7_SbjM0Q3MWRxYw1EAEguoTAM2ClwKOApAGgAYj5ivMoyAEJqQKGbyuXgxylPqgDAaoE1AFP0DjlR2v3I1H2C0jGIM8bMoWN1KuP4Im7c0FCovVZ9lSw4ly8TSkhMoWjK-9r92SfSV_wOQEf723nrtx7Nu4bkSAsGNTLKIQY_wb6faMwS_W_o-a2AW67ABCDQTGicaEpTlS4WmHXgmxuEMRrkSOJuKzNVuakTE-_dJIS6fSB9x-a_oqFevfXJyl6Oah1G-lDeexAghLAqpyF79UVT9SC1fbjB3Ca5TUiGdDZ_f2Ylh3_JAAWi5_LT3UPIqvOFfKbtf4MVzk_mz5EzCqrts3kV2algMAEwPmHwZME4AQDkAYBoAZNgAeIsdvSA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgOYCwHICwGADAGwE8jl5xDQEwDYEw3YFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJeRoZqdY8NualZ4IFFxajYcnzvtrbSnLv5ag-nqLdBTXPg3wPDU%26sig%3DAOD64_1t_TmHafFBVcEvdDhYqjZywPK3ow%26client%3Dca-pub-8933329999391104%26dbm_c%3DAKAmf-DUijBXTKZSbnoJ8dgKAMBHe2S9pgay12MAsAOL39nLWCXVM_qCrLtwYQli8DHaIfvBFmiSnRgDnb_ZO9gFLk7dJTUqRw2wi5IOnfp2r-Y1fsX7xBiRmoqJtkjS_IuirJgajrUahsD2WhkCFCqbZ2DWxZvrUADK9EB0F8_E8nJ8sgPnOng%26cry%3D1%26dbm_d%3DAKAmf-DhtwvVZfsYRUaZ5p7qWGDtD0l4IXYZlUmXMnii4nbfO57URJReRr5JqxOSKmxz5lomnpUl2hs6wiGcbW3BO3rTVf2he6RkVUqP8CrIAYZRAiisY3DOaS5Up46wa_DHdKkojuatIpbq8XR0tLR1w2NUb08xKdv6_yHKYgHwtXt_C8kiFqU1kPfYqevYKSLLPZObyeOitWzofZvzu_ieOjeTfDznAw1XGPi9LuhtqRC8G8uhVGCQh77S1EFl4TI-1kjRptXw9AfhgZTScACwPM3HJk3d_BnyoZB6OqzqRHpjrcJDIamHqekluih3ktRKxEOlh2-QwrqqHsNP3eJyAPvozBJSGfP6_dmoMUXaYtOaaaYoRv8c0RlQQcZRIhtA233kr816BeQh2IeZPMxlAbd2rgsflELjlpwlMXQep_ghN35QyyzBZfxElCS4bztbLkoHdr9aIpz8-IcxBcZpdSZIq4OhUj548bBorXrtiZZwXBuETOwUJH0kcPpMSt7qjFEAfZWXicfR43mYEXiR2ds9fnrDBJcsxMqzS9-8Ojb2vV_NiiBEp6VUAF6ofbAbctmP6cHWU7z8XDX6hQpNgNjUgsYBOQQ_U_-KcTkR2pshLgp0BFKhWF1P6bQ0l19dnFXNy-CugAewSRr-nN7eYV03MyjhLw%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=-.aoFsUgFb;stc=1;chaa=1;sttr=185;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 18:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80942
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 26 Oct 2022 18:51:51 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A7BE 22 KB
8 KB 171ms
170ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 567017
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 07 Oct 2022 03:50:36 GMT
expires: Sat, 07 Oct 2023 03:50:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 main.19.8.355.js Show response
static.adsafeprotected.com/ Frame 5F45 194 KB
60 KB 453ms
451ms Script
application/javascript 18.155.145.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.355.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10933&advId=1008917700&campId=18563143810&pubId=1&chanId=881479034793&placementId=445254004&dealId=&adsafe_par&impId=ABAjH0ivbhIJmEdEtPQSupELnbYe&bidurl=https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.145.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-145-129.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 81e5cc1058a8711411ee3244831936a088543cbd86b5eaa579e258d9c456e8b1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:12:46 GMT
x-amz-version-id: Os.8EiheWKF00Q0a8Kg0Ad0ou3MT9I_t
content-encoding: gzip
via: 1.1 107d9675170d96f52a4921f960f44e7c.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-P1
age: 612488
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 06 Oct 2022 10:37:53 GMT
server: AmazonS3
etag: W/"739a5ec7d51544e57ec8eba795c7ad5e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: g17DiWksose_NMpvtqsLz5diGpHCteZ1bioi3MvV_go8zrcn8ZNTiA==

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1394 1 KB
648 B 169ms
168ms Document
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 56751
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 01:35:02 GMT
etag: 48472445140208031
expires: Fri, 14 Oct 2022 01:35:02 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 5F45 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad8045896d9bd2e40b22f8c0a4c3afb970b7da1c3b667afd4528e0b984e44171

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 293ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=c07b1487-ffc3-0027-d04b-13e18e1489e6&tv=%7Bc:qWFQfU,pingTime:-10,time:1521,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODkuMC40Mzg5LjcyIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1665681653441%7C%7Cc69b1f429c905f2297e612146c5a6ea4%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C10aa99c0a1a28160c78a061a626af507%7C%7Cd348734c93e947fd19248375e2f0ff66%7C%7Cd1621bf054480c748d5d35a70f41eec0%7C%7C703f6f2eba516ac769d151306e802804%7C%7C727c9b0ee3bbd9dfb743e1b4f66084af%7C%7C1663701684%7D
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D48C
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEFknsGDj1KqqCzUqZVtmRZk&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEFknsGDj1KqqCzUqZVtmRZk&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M3VKbFhqcjMxT0oxVDg1&google_gid=CAESEFknsGDj1KqqCzUqZVtmRZk&google_cver=1&google_push=AZmPxg_UCenpufURwOzB1aVRgH-dDySwhDbdcUwUBYd4TgX...

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M3VKbFhqcjMxT0oxVDg1&google_gid=CAESEFknsGDj1KqqCzUqZVtmRZk&google_cver=1&google_push=AZmPxg_UCenpufURwOzB1aVRgH-dDySwhDbdcUwUBYd4TgXsJevr8vYWq2JwlrnbPs9CC_el_aG-3hdqIJjZq7NNdQP28A1lBPepOJfSq8CubN8j7-NZduUg904tMnsLj3iMh8OFKsRB6bJq2A

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:53 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-0be4466892d3f37f0@ap-southeast-1a@dxedge-app-ap-southeast-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M3VKbFhqcjMxT0oxVDg1&google_gid=CAESEFknsGDj1KqqCzUqZVtmRZk&google_cver=1&google_push=AZmPxg_UCenpufURwOzB1aVRgH-dDySwhDbdcUwUBYd4TgXsJevr8vYWq2JwlrnbPs9CC_el_aG-3hdqIJjZq7NNdQP28A1lBPepOJfSq8CubN8j7-NZduUg904tMnsLj3iMh8OFKsRB6bJq2A
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame D48C
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESENHi4tfptti1PuNYMD8_jOo&google_cver=1&google_push=AZmPxg8HY5qGMqjPazpkf6a0Gj3DYemNMCEMFqoypu71eJeaPr6-W_WYaAIRq7M1Yn6NVa7BuslQTifq60zJoT40sRWgbVkp2_s7d...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENHi4tfptti1PuNYMD8_jOo&google_cver=1&google_push=AZmPxg8HY5qGMqjPazpkf6a0Gj3DYemNMCEMFqoypu71eJeaPr6-W_WYaAIRq7M1Yn6NVa7BuslQTifq60zJoT40sRWgbVkp2_s...

43 B
441 B

270ms
267ms

Image
image/gif

172.64.152.245
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENHi4tfptti1PuNYMD8_jOo&google_cver=1&google_push=AZmPxg8HY5qGMqjPazpkf6a0Gj3DYemNMCEMFqoypu71eJeaPr6-W_WYaAIRq7M1Yn6NVa7BuslQTifq60zJoT40sRWgbVkp2_s7drkoq2eY1WhsioZh8c7F8wzkHBfGFPSTMaKc2qINTCG-Ow&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAZmPxg8HY5qGMqjPazpkf6a0Gj3DYemNMCEMFqoypu71eJeaPr6-W_WYaAIRq7M1Yn6NVa7BuslQTifq60zJoT40sRWgbVkp2_s7drkoq2eY1WhsioZh8c7F8wzkHBfGFPSTMaKc2qINTCG-Ow%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 172.64.152.245 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7599bfa19f965a4f-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 100
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENHi4tfptti1PuNYMD8_jOo&google_cver=1&google_push=AZmPxg8HY5qGMqjPazpkf6a0Gj3DYemNMCEMFqoypu71eJeaPr6-W_WYaAIRq7M1Yn6NVa7BuslQTifq60zJoT40sRWgbVkp2_s7drkoq2eY1WhsioZh8c7F8wzkHBfGFPSTMaKc2qINTCG-Ow&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAZmPxg8HY5qGMqjPazpkf6a0Gj3DYemNMCEMFqoypu71eJeaPr6-W_WYaAIRq7M1Yn6NVa7BuslQTifq60zJoT40sRWgbVkp2_s7drkoq2eY1WhsioZh8c7F8wzkHBfGFPSTMaKc2qINTCG-Ow%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7599bf9f9e555a4f-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D48C
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIpUO5nZxptc6HvjqFJKEYA&google_cver=1&google_push=AZmPxg_2zv6evC2hALYwnsYEuERwB0BWAvZoR0hJ_ionnA42T0NVjzia_Cw6UTvMF5S36VHnvDD-lUpmLdUhdSIWb6...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZTQ5NzVmOWQtNmFmMS00MzMyLThhMGYtZjQ4NzcxMDA0ZGMx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=e4975f9d-6af1-4332-8a0f-f48771004dc1

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZTQ5NzVmOWQtNmFmMS00MzMyLThhMGYtZjQ4NzcxMDA0ZGMx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=e4975f9d-6af1-4332-8a0f-f48771004dc1

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZTQ5NzVmOWQtNmFmMS00MzMyLThhMGYtZjQ4NzcxMDA0ZGMx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=e4975f9d-6af1-4332-8a0f-f48771004dc1
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame D48C 0
174 B 355ms
177ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESECGr8XHvdnI5yOiAYtOZaJs&google_cver=1&google_push=AZmPxg9W9P7IpdY510vn_4ne0mLbucIdAKOCid5q4vb9VtW8i_puVC5o30vKlc6hvR1Qky13BNB4jJQhXEv5wueHNcrSow7_H1ujxKpqWAo3DbX5dJRA01OnC_1sGOZkxTUNlQZ7o8f3_7ur0A
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D48C
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESEAdtORK49r-2TiZ2Umy_YcI&google_cver=1&google_push=AZmPxg9-mDW-4Kps_Sc_ceOnaL1Oohg97CDAItBwQijLydMoHo2xBKmUMJbyvAxNEZj0R-tlhdMv9SHyPYMlZlpjuprgBQn4ndqjefBKq...
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=c1ZoRHBBR1hBMzJiM2xlazlVaElZdw%3D%3D&google_push=AZmPxg9-mDW-4Kps_Sc_ceOnaL1Oohg97CDAItBwQijLydMoHo2xBKmUMJbyvAxNEZj0R-tlhdMv9SHyPYMlZ...

170 B
188 B

174ms
173ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=c1ZoRHBBR1hBMzJiM2xlazlVaElZdw%3D%3D&google_push=AZmPxg9-mDW-4Kps_Sc_ceOnaL1Oohg97CDAItBwQijLydMoHo2xBKmUMJbyvAxNEZj0R-tlhdMv9SHyPYMlZlpjuprgBQn4ndqjefBKqWxeJQIAzKwbVpW2c1v-_Dqg76qpRVrOoHJlq1a8

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=c1ZoRHBBR1hBMzJiM2xlazlVaElZdw%3D%3D&google_push=AZmPxg9-mDW-4Kps_Sc_ceOnaL1Oohg97CDAItBwQijLydMoHo2xBKmUMJbyvAxNEZj0R-tlhdMv9SHyPYMlZlpjuprgBQn4ndqjefBKqWxeJQIAzKwbVpW2c1v-_Dqg76qpRVrOoHJlq1a8
date: Thu, 13 Oct 2022 17:20:53 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: nginx
content-length: 287
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D48C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEERRvej6ZWEpcmOczpUt6cY&google_cver=1&google_push=AZmPxg_cBIFSP7_-JljytyZ_XDrdU06jBFWJrL67-nD9XJ-SZTf_MtGYpd0OxmA2J5b-jh1HYABCINl8C7rwpo-aGY-ofFN...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AZmPxg_cBIFSP7_-JljytyZ_XDrdU06jBFWJrL67-nD9XJ-SZTf_MtGYpd0OxmA2J5b-jh1HYABCINl8C7rwpo-aGY-ofFNgi-aKz9ENolzSxgizzPgstNRFA2UbRLsWLkNqr...

170 B
188 B

174ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AZmPxg_cBIFSP7_-JljytyZ_XDrdU06jBFWJrL67-nD9XJ-SZTf_MtGYpd0OxmA2J5b-jh1HYABCINl8C7rwpo-aGY-ofFNgi-aKz9ENolzSxgizzPgstNRFA2UbRLsWLkNqry--kTRKsc-y&google_hm=NTUzMzQwMzc3MTQ2NzAzMzg3OQ%3D%3D

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 13 Oct 2022 17:20:53 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AZmPxg_cBIFSP7_-JljytyZ_XDrdU06jBFWJrL67-nD9XJ-SZTf_MtGYpd0OxmA2J5b-jh1HYABCINl8C7rwpo-aGY-ofFNgi-aKz9ENolzSxgizzPgstNRFA2UbRLsWLkNqry--kTRKsc-y&google_hm=NTUzMzQwMzc3MTQ2NzAzMzg3OQ%3D%3D
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D48C
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEADfUVzq1NPFvzlQyr_2Ies&google_cver=1&google_push=AZmPxg_m2O8DFCtpW...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D&google_gid=CAESEADfUVzq1NPFvzlQyr_2Ies&google_cver=1&google_push=AZmPxg_m2O8DFCtpWWKaUwCSP55FoVYefh...

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D&google_gid=CAESEADfUVzq1NPFvzlQyr_2Ies&google_cver=1&google_push=AZmPxg_m2O8DFCtpWWKaUwCSP55FoVYefhFg58z0SGF-JZaiNPNY-NcwPI6xjP7ta3nCzFj5Zg3uYqWazX-SnQydj8nLRyAxS9FbuNl2qkrNlgm3V4iO_EIiCcKS8Su1R0ampUUm8cXCe6AIXQQ

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
AN-X-Request-Uuid: baba50d6-3a2b-4a54-ab3d-77884297f985
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODQ0NTMyODQzMzQyNTQyMjE3Mg%3D%3D&google_gid=CAESEADfUVzq1NPFvzlQyr_2Ies&google_cver=1&google_push=AZmPxg_m2O8DFCtpWWKaUwCSP55FoVYefhFg58z0SGF-JZaiNPNY-NcwPI6xjP7ta3nCzFj5Zg3uYqWazX-SnQydj8nLRyAxS9FbuNl2qkrNlgm3V4iO_EIiCcKS8Su1R0ampUUm8cXCe6AIXQQ
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D48C 0
12 B 174ms
171ms Image
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IygFH6nvroK2cK5zvzB8Ff3ewiKfG2GWDsjJMsOzHBoym47klicLF2Fonx70R8YiI6Q7zjug

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 OLZMwUuXKff5QHkWgJZ5Acpn9ezP58Pxr98BvfUDCEE.js Show response
pagead2.googlesyndication.com/bg/ Frame C490 36 KB
16 KB 170ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/OLZMwUuXKff5QHkWgJZ5Acpn9ezP58Pxr98BvfUDCEE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38b64cc14b9729f7f940791680967901ca67f5eccfe7c3f1afdf01bdf5030841

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 12 Oct 2022 19:06:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80057
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16062
x-xss-protection: 0
last-modified: Tue, 11 Oct 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Oct 2023 19:06:36 GMT

GET
H/1.1 200
OK log
c21lg-d.media.net/ Frame 24C6 35 B
296 B 1717ms
1006ms Image
image/gif 23.36.48.24

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-c&ovsid=fZrDWuvUp64569d8pc4ijlxuR5lGEqkK&cs=15&vsid=3086832531539728000V10
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.48.24 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Thu, 13 Oct 2022 17:20:54 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 296ms
295ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=c07b1487-ffc3-0027-d04b-13e18e1489e6&tv=%7Bc:qWFQhg,time:1605,type:e,im:%7Bpci:%7Btdr:1528%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:1605,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1598~0%5D,as:%5B1598~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:1331,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16.1193990-66063503%7C161%7C162%7C17*.1193990-66063505%7C171%7C172%7C181%7C182%7C19%7C1a,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:23,sis:376%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: nginx
x-server-name: dt19.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 1394
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESENZDuGa5KMjva-H74kaIAHg&google_cver=1&google_push=AZmPxg82QgAlQaOPDJC760IAxrtFtaDd1zVm4VK6O-qXD6qVGotd-QzMR4F8x0uNcENgO70PSsc5Zj-WFrgdifMHMYa-ZzKg6DWMc...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDAwMjQwNDQ4Njc1OTYzMTc0Nw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESENZDuGa5KMjva-H74kaIAHg&google_cver=1

43 B
398 B

476ms
202ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESENZDuGa5KMjva-H74kaIAHg&google_cver=1
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESENZDuGa5KMjva-H74kaIAHg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 1394 35 B
362 B 176ms
172ms Image
image/gif 103.229.10.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEI8hXFH4yRHPw7OCAoE1pXA&google_cver=1&google_push=AZmPxg84RSg4WNCTgQI67Dbm9dyN5MznwAj_u4_v6Yk1B0UKr7AFzoIspSwYVR33sW7J0CwjBWF6vEGFFO2x3jeQ6CIFXUHaEovEBE8UfReMFFcH379T7hILKE528NfghyY40WBSkFuihc-W

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.192 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1394
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEEq6Vtfsq_Ypc0HcSDY_m1U&google_cver=1&google_push=AZmPxg_p-MFT16xGs94GADEeroa8Og3Im2F_w1m2W1Tmm3qdYjXCUhArCHwJzXR4ozHh6d7UB7UJxMqaI62uD_HB...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AZmPxg_p-MFT16xGs94GADEeroa8Og3Im2F_w1m2W1Tmm3qdYjXCUhArCHwJzXR4ozHh6d7UB7UJxMqaI62uD_HBjwqhR_TQJQ2j7fRmOrZ8Ls-91lB04P...

170 B
188 B

173ms
173ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AZmPxg_p-MFT16xGs94GADEeroa8Og3Im2F_w1m2W1Tmm3qdYjXCUhArCHwJzXR4ozHh6d7UB7UJxMqaI62uD_HBjwqhR_TQJQ2j7fRmOrZ8Ls-91lB04P-C5gdr6WK84Trlx7xfX3X3gNGc

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 13 Oct 2022 17:20:53 GMT
Server: MT3 4539 98cc2da master hkg-pixel-x18 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AZmPxg_p-MFT16xGs94GADEeroa8Og3Im2F_w1m2W1Tmm3qdYjXCUhArCHwJzXR4ozHh6d7UB7UJxMqaI62uD_HBjwqhR_TQJQ2j7fRmOrZ8Ls-91lB04P-C5gdr6WK84Trlx7xfX3X3gNGc
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 13 Oct 2022 17:20:52 GMT

GET
H/1.1

200
OK

sync
gdn.socdm.com/rtb/ Frame 1394
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google&sspid=google&google_gid=CAESELQcbTyNYLlr12Bg3b_64L0&google_cver=1&google_push=AZmPxg8wEV0068mEAW4J8et193tn-GEj_KaAle8DCVDhkscq34DYYxYAHW4Tb-4c1VzqE...
https://cm.g.doubleclick.net/pixel?google_nid=scout&google_cm&google_hm=WTBoSTljQ281c0VBQUlSbVp4b0FBQUFB
https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESELQcbTyNYLlr12Bg3b_64L0&google_cver=1

43 B
979 B

1011ms
228ms

Image
image/gif

202.241.208.4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESELQcbTyNYLlr12Bg3b_64L0&google_cver=1
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 202.241.208.4 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:54 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync?proto=google&sspid=google&google_gid=CAESELQcbTyNYLlr12Bg3b_64L0&google_cver=1","cluster_id":21,"gdpr":false,"ipv4":"103.209.254.101","key":"Y0hI9cCo5sEAAIRmZxoAAAAA","privacy_sensitive":false,"uid":"Y0hI9cCo5sEAAIRmZxoAAAAA","upstream_id":"m-ad341"}
X-SO-Key: Y0hI9cCo5sEAAIRmZxoAAAAA
X-SO-Upstream-ID: m-ad341
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad341.dc4p.scaleout.jp
X-SO-UID: Y0hI9cCo5sEAAIRmZxoAAAAA
Connection: keep-alive
Content-Length: 43
X-SO-IP: 103.209.254.101
X-SO-Cluster-ID: 21
Server: nginx
Content-Type: image/gif
Cache-Control: private
X-SO-Ads-Time: 6
X-SO-LB-Hostname: a-ng40012.dc2p.scaleout.jp

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://gdn.socdm.com/rtb/sync?proto=google&sspid=google&google_gid=CAESELQcbTyNYLlr12Bg3b_64L0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 318
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1394
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMk3nfgZBMyrTYXDyfomO-Q&google_cver=1&google_push=AZmPxg_3npygUMSfPdzEKf6FZ_gFktkvjyF3iQj5jown3IoWUhXYOyuglh0KToPkXK3yEMgeLOw...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDk3QlVIWVAtRS1FNUZY&google_push=AZmPxg_3npygUMSfPdzEKf6FZ_gFktkvjyF3iQj5jown3IoWUhXYOyuglh0KToPkXK3yEMgeLOw4z-ML9snkxb0NNPAJfENbJiKApgH8w...

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDk3QlVIWVAtRS1FNUZY&google_push=AZmPxg_3npygUMSfPdzEKf6FZ_gFktkvjyF3iQj5jown3IoWUhXYOyuglh0KToPkXK3yEMgeLOw4z-ML9snkxb0NNPAJfENbJiKApgH8wIBS7TDSKN0z31y1s5da6oSmJo0qgNsaC68Kg0Um

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDk3QlVIWVAtRS1FNUZY&google_push=AZmPxg_3npygUMSfPdzEKf6FZ_gFktkvjyF3iQj5jown3IoWUhXYOyuglh0KToPkXK3yEMgeLOw4z-ML9snkxb0NNPAJfENbJiKApgH8wIBS7TDSKN0z31y1s5da6oSmJo0qgNsaC68Kg0Um
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
Expires: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 1394
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESELsqXW36BaquXgc6kwNRL1c&google_cver=1&google_push=AZmPxg8caojJ1HV0xrdeCzBNLgSnHNSJMM5GipfYzyWb9_cmI8zilqc0PxZRWM-o1SSbzTldh-BqQKu-i0Q...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABg9Jc_8oy3yHq2OTD95UHSClXCrr6oSZgtg&google_push=AZmPxg8caojJ1HV0xrdeCzBNLgSnHNSJMM5GipfYzyWb9_cmI8zilqc0PxZRWM-o1SSbzTldh-BqQKu-i0...
https://onetag-sys.com/match/?int_id=19&google_error=5

0
340 B

327ms
327ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame 1394
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESELbtEhcvavTP3jdtgAQdS4A?ext-param=AZmPxg9DcNgwKUySPj-B1IiwQpfJSA2IudCzxOnYU_WKM2RB3yr2b3KP-sOEudQ8f-TZElFq2f-J-Xl5CM9h3zEpGj9S0mUzrA6ldA65acTIbR9jRlk0G8cNEN-S...
https://an.yandex.ru/mapuid/google/CAESELbtEhcvavTP3jdtgAQdS4A?redir-setuniq=1&ext-param=AZmPxg9DcNgwKUySPj-B1IiwQpfJSA2IudCzxOnYU_WKM2RB3yr2b3KP-sOEudQ8f-TZElFq2f-J-Xl5CM9h3zEpGj9S0mUzrA6ldA65acTI...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESELbtEhcvavTP3jdtgAQdS4A&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
168 B

363ms
362ms

Image
image/gif

77.88.21.90

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

77.88.21.90 -, , ASN (),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Thu, 28 Sep 2023 17:20:55 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1394 0
12 B 172ms
171ms Image
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L7vEQYbJOCYYIAOF-YZq2mAltC7cmTn6wRZRQOCd9s5cD_qvh2oepJrHJktkeDK_6aMJ7DRzc

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js Show response
pagead2.googlesyndication.com/bg/ Frame A7BE 36 KB
16 KB 170ms
168ms Script
text/javascript 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/75n5MIkdKjMQGlOCWCYwhumMUPtaURPkn9Lrop-Fp5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef99f930891d2a33101a538258263086e98c50fb5a5113e49fd2eba29f85a795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 11 Oct 2022 05:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215352
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15870
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 05:31:41 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 293ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=bec59399-84d1-ed6a-fb82-930da26a5b4b&tv=%7Bc:qWFQhH,time:1583,type:e,im:%7Bpci:%7Btdr:1508%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:1583,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1577~0%5D,as:%5B1577~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:1340,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.1193990-66063503%7C161%7C162%7C17.1193990-66063505%7C171%7C172%7C173%7C181%7C182%7C19%7C1a,idMap:16*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:22,sis:374%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame B486 31 KB
10 KB 317ms
316ms Script
text/html 184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 116f5d8b824fc3d431bfcd8537915e4a8ad7683fa5580cf4314bbc91cfccd95a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:53 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Sep 2022 22:38:47 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=17807
Connection: keep-alive
Content-Length: 9422
Expires: Thu, 13 Oct 2022 22:17:40 GMT

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 6102 91 KB
23 KB 357ms
357ms Script
application/javascript 18.155.145.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.145.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-145-129.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 107d9675170d96f52a4921f960f44e7c.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-P1
age: 1907077
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: uPPllZJwkHaVPii3ZUayKV2ot-uK5e1sqQe9cw1VzrG82dViyVyJuw==

GET
H2 200 mon
pixel.adsafeprotected.com/ Frame 1C44 43 B
216 B 178ms
177ms Image
image/gif 52.221.37.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=10933&advId=1008917700&campId=18563143810&pubId=1&chanId=881479034793&placementId=445252796&dealId=&adsafe_par&impId=ABAjH0igJ7x1lTujPDYebt31MnHw&bidurl=https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&adsafe_url=https%3A%2F%2Fwww.bg3.co%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:7fa3bc7a-6408-12ef-a12d-74ca37b35dbb,c:qWFQlJ,sl:na,em:true,fr:false,thd:1,mn:jsserver-primary-5b77d768f7-dj9mn,rg:sg,pt:1-5-15,mu:10000,br:c,bru:c,an:n,oam:0,scm:publ1.grpm1,mtim:565,mot:0,app:0,maw:0,fm:tkaisYt+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:582,oid:62dd1771-4b1b-11ed-ba64-6af31e1811cb,v:19.8.355,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.221.37.40 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-221-37-40.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: nginx
x-server-name: app02.sg.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 292ms
292ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=c07b1487-ffc3-0027-d04b-13e18e1489e6&tv=%7Bc:qWFQm3,pingTime:-2.1,time:1902,type:a,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:1902,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1895~0%5D,as:%5B1895~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:328,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16.1193990-66063503%7C161%7C162%7C17*.1193990-66063505%7C171%7C172%7C181%7C182%7C19%7C1a,idMap:17.7fa3bc7a-6408-12ef-a12d-74ca37b35dbb.27_10933%7C17*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:23,sinceFw:90,readyFired:false,sis:376%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: nginx
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C490 0
25 B 173ms
172ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B83fw9EhIY-GEOIuW4t4Pm8OLqA0AAAAAOAHgBAI&bg=!kJOlk9fNAAYeOJy_Pjg7ACkAdvg8WkDBhAiOXwfYhB8D1CNs46MMgZjflIQ_RnBEkyziFWQziDSEMgIAAABvUgAAAAJoAQeZAvJOtqteWJRwJK6ZNPVT-P1wYlqw9X9QZgr8QaemkwscoRMkesLgrUifKTX-y_0XL4JV01CywVi7jFLKBzzFGYz3SM3FerwmEchZZEhO4ZSUKk6di4HPpFZScv5dlVfwAWXgF7Upkl62Z_Mq0h8JixwWDim-4L5hopOpZY-QsVyIoGL4hf5OEWnaFJoNWiqTDj_k8TNWy1LPUoAyRcUo81a9E_kde1kQYv9tvtjr1lJlRcEg97SGiMRAYp-3ssM2KxSniklBaIqHRvwe0pkhYz19a54w8R3BCSB-b6Kc-VyhBsrGEtIEU8oMyDgy_J6ap3g2K1gnK_amGnbqeKelW0hOUs8VlvIvpBROM8QahLGpCmhiZraP2Qj1t0eJ-q9j4fvpo5gs1QWK7MImUiVzgBNbBwW7zKC58E1H-r82FWggHVormzJE573NKCnw20CApN3fzMxASQK_5U7MXDUgncq4zIBgTQqXmPH37EIs2Mo5V_JJBASs6gQHgTpLBjfMV5QBNBOHdko5km0zjDPSKi2f4j6vnnmVnmRqwY-9mx1VCDb04KG4OLE4Az_YVTHzj97JadEy37e3xci5OItLR82CK3LNgFdYFLNtpEDdSYv_eMiV-eUwy7IbLfUeZUBllkIx6ptDeRVtAiREqGgUbQdErvI-B39aXK7lf4gujpE63qZpOzgMdFE9eUx5zITjm177Adb0Ce5O56V737oq048tstylE-PxQi0xkQREsnaJ6knt_2f1oOZLvYWj6PtIZzS3_NyaXBUhYx91cPLI_Pks5IkwEPw_EDXBsMg6qVa74wv1hzrTGkIjGJCO_TKtCq2uxE3PFSQhAKAdO_tHfi9B-GKP2TmRdFuPp4ML7jXxCTOhQYZ-UAG27JKsYk5NIfXKSDj_qkkFdmTcxUUT4Sbs3QdLnHedhHevUG7FGDww_ipNnbOeCWfHuXEEANp0q4XPx2-44ywSA4oJtvX30KGnkF92WeHmzXxacydPx00OhJzb

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 293ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQm8,pingTime:-3,time:607,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:582%7D,%7Bpiv:0,vs:o,r:l,t:606%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:607,n:606,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:581,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B39~1,0~0%5D,as:%5B39~728.90%5D%7D%7D,%7Bsl:o,t:606,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkaisYt+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:583%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 293ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQm9,pingTime:-6,time:608,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:608,n:606,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:581,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B39~1,0~0%5D,as:%5B39~728.90%5D%7D%7D,%7Bsl:o,t:606,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B2~0%5D,as:%5B2~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkaisYt+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:583%7D&tpiLookup=ao:www.bg3.co*&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 294ms
292ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQmv,pingTime:0,time:630,type:pf,im:%7Bsf:0%7D,sca:%7Bdfp:%7Bdf:4,sz:728.94,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:582%7D,%7Bpiv:0,vs:o,r:l,t:606%7D,%7Bpiv:100,vs:i,r:,t:630%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:630,n:606,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:581,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B39~1,0~0%5D,as:%5B39~728.90%5D%7D%7D,%7Bsl:o,t:606,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B24~0%5D,as:%5B24~728.90%5D%7D%7D,%7Bsl:i,t:630,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B0~100%5D,as:%5B0~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17.c07b1487-ffc3-0027-d04b-13e18e1489e6.12_1193990-66063505%7C17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:583%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 293ms
292ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQmx,pingTime:-2,time:632,type:a,im:%7Bpom:1,prf:%7BbeA:3020,beZ:3021,mfA:3585,cmA:3586,inA:3586,inZ:3589,prA:3589,prZ:3597,si:3602,poA:3603,poZ:3617,cmZ:3617,mfZ:3617,loA:3628,loZ:3631,ltA:3652,ltZ:3652,mdA:3021,mdZ:3554%7D%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:582%7D,%7Bpiv:0,vs:o,r:l,t:606%7D,%7Bpiv:100,vs:i,r:,t:630%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:2,o:630,n:606,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:581,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B39~1,0~0%5D,as:%5B39~728.90%5D%7D%7D,%7Bsl:o,t:606,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B24~0%5D,as:%5B24~728.90%5D%7D%7D,%7Bsl:i,t:630,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B2~100%5D,as:%5B2~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17.c07b1487-ffc3-0027-d04b-13e18e1489e6.12_1193990-66063505%7C17*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:583,sinceFw:49,readyFired:true%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 175A 1 KB
1 KB 471ms
291ms Document
text/html 104.18.18.126

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 33f03b0f5e11769479fd9f8491eead408e275a5aec60f70cb931831d814f84a2

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7599bfa24a733776-MEL
content-encoding: br
content-type: text/html
date: Thu, 13 Oct 2022 17:20:54 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gjWCWONn3RfgXRkoKwTlW3goDjCB7cZNIJDQC5d8yrlaQzpMSr8%2F7BNnIIQz3V1H9uz2AH9vB2OB9m6pQEft31KLoSPIYqx9758SHIzlvIJ5igdXAchX4%2Fdk2r9SpgRwdlzbdDU%2BFQ2g3A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A7BE 0
25 B 173ms
173ms Image
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BYC8y9EhIY72UOP614t4Pn9Kc6A8AAAAAOAHgBAI&bg=!5Oel56PNAAYqRg79CkY7ACkAdvg8WvOO_cabRVixCnsX4YOlpVOiVgJFo17GynFXcmfj72q-SclHIgIAAACwUgAAAAFoAQeZAt2OaJVxeC9oU8t_2UPPYUSQCXPxr7ke8A1jCdV3wOnV2QWDAjQrurILUaLqmMewEAC1L_4hMOYXZN_NAJe7Emx2UfdwtTZrRzKiHdY3Ewh4SBsoVj1qQ_kBvvtkk6g6QMX4NCiQYrz0IW-lzsVGDlt-qdZweLMv5VdI6Xy53MvqVv9IataVxejysi2dB-dF19lbCPU5qDiHBeJfVc4zjx-7k5gGVZbkhZ5JCuY6vPA1B10UK-N8o757kL8n3x2RsnGS6gm3RMqywMqMdtLa-X_NzucU1QojMwDzZa-w2pwOGmFViM8IT760qh_KmFHW4dRrfdIm2ygVILB0v8yNEQQqLLHiTKOM3_MJpPhZHIHGkohcfEPrLLH_DQZ4s1aKPrgq6hsjgajRG8sbXicyq8EczIrYSPuEy9zMWz5lreQk3dZNX-nJyP_YZ_PwjhGducWumU6WM5rz0hB1v3w0-1jUYNcVSoDIM1FTGMyRws0J7Pg5DO-HpLm5vW7XEfomM92TaL-7aSs7Oc306drksPvOgYnVVHjQEXX7BCfsyyN9oanduvUEfkP1HlLtmnABsfVA1s2y3oohuRKqdHz1it8msbjZ4IJVH-kV1kY7q0xY-NJaeU7eEBNsKdedoMG2s6dqb-6aApVu8NgoyigTfsImwm2SUbus2wt2y4VKDU1QNfmAe1wXqSybbJq7Acq489l87q1B9JzUVZsE1dZuRX7xUo0qxCTc92Rdk2zlKdD8guL-sLAbnIMND8PZuvb_w8TQ9pinhgvoIt-TLH80uqxxmwkQxb4WeRXQCeXKvf0LDBVjvQFP1V-b8b_wqyhOwSjsO0DT5Kk90mmddbBvCahU8yBg_LrRjp9jZM2hOlpzpc51wBUDBzYm6_U-UzFRsy_voeFZGiWhGwxgMehcD8Wir_dvvAZCqBa23oJgRD1y_W89Xqm4QFj8n8JiamFHGVwGQNCA5E7QBmETyzgZ

Requested by

Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C149 15 KB
6 KB 351ms
318ms Document
text/html 104.65.228.208

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.228.208 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=39163
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 13 Oct 2022 17:20:54 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 14 Oct 2022 04:13:37 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 1FBB 4 KB
2 KB 728ms
240ms Document
text/html 52.193.52.82

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.193.52.82 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ff1956f7dd01403c3f502b2fb72d88ce9d1713722203f7bd29c6eda1635b2116

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 13 Oct 2022 17:20:54 GMT
etag: W/"0b966e7b18f27cfaa7c3a61e330f8b600"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 642E 4 KB
2 KB 328ms
328ms Document
text/html 51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

490caa74cf1a8f43af9fb22811915983edfb809f61d8419429a71cdc0e1cd4ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1398
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame FE7D 768 B
870 B 173ms
172ms Document
text/html 23.106.127.164
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.164 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 957c8a0be7ac34904116c2e5bd7d3153ac14d23b48416d900633ebbc888c125a

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-length: 768
content-type: text/html
date: Thu, 13 Oct 2022 17:20:53 GMT

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 43EB 2 KB
939 B 445ms
296ms Document
text/html 104.18.18.126

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: d4f72de23f795b64b561fb0787c3ee241a367cb775bed0d071a5416252309c57

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7599bfa24a753776-MEL
content-encoding: br
content-type: text/html
date: Thu, 13 Oct 2022 17:20:54 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BQBlxNTuFUu7PzjEZ9q0QENUcbQjK%2BpXKQWz%2F1%2B%2Fi5lpceqfSC08q9Po4qSBNsyGHzqBr2izAwi3GBZrbLjLKDF0OLJBQ1G%2Fnb9y7cIXwmY2Ok0O451D5BvCgqClmRslhfKvuXZmtEyN%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame A838
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
554 B

317ms
315ms

Document
text/html

184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 13 Oct 2022 17:20:54 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 13 Oct 2022 17:20:54 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2

200

setuid
x.yieldlift.com/ Frame B363
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=0&gdpr_consent=&us_privacy=1YN-&
https://x.yieldlift.com/setuid?bidder=rubicon&uid=L97BUHYP-E-E5FX&gdpr=0&us_privacy=1YN-

0
189 B

944ms
321ms

Image
text/plain

138.197.50.103

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.yieldlift.com/setuid?bidder=rubicon&uid=L97BUHYP-E-E5FX&gdpr=0&us_privacy=1YN-

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Server

138.197.50.103 -, , ASN (),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
vary: Origin

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://x.yieldlift.com/setuid?bidder=rubicon&uid=L97BUHYP-E-E5FX&gdpr=0&us_privacy=1YN-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 808ed95536e7f55d8adbcb9fc76d309d
Expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=8445328433425422172

0
344 B

358ms
356ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=8445328433425422172
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
AN-X-Request-Uuid: e5b390c6-f1ab-40d1-bbb6-cfe440df6521
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://ads.servenobid.com/sync?pid=312&uid=8445328433425422172
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=FeaQDRZHgYibJgvbTbqqVDW0

0
350 B

360ms
359ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=FeaQDRZHgYibJgvbTbqqVDW0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=FeaQDRZHgYibJgvbTbqqVDW0
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3sfo1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID&sovrn_retry=true
https://ads.servenobid.com/sync?pid=310&uid=FeaQELZHBSemSAIQRz-2NYW_

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://x.yieldlift.com/getuid?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D314%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=314&uid=c8d4b455-a7a8-46ec-b425-cc9e149b0564

0
356 B

357ms
357ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=314&uid=c8d4b455-a7a8-46ec-b425-cc9e149b0564
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=314&uid=c8d4b455-a7a8-46ec-b425-cc9e149b0564
date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 119
vary: Origin
content-type: text/html; charset=utf-8

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3374051091
https://sync.1rx.io/usersync/tradedesk/e4975f9d-6af1-4332-8a0f-f48771004dc1
https://sync.targeting.unrulymedia.com/csync/RX-2123905e-4908-47d5-ab08-e35a997eea08-004?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-2123905e-4908-47d5-ab08-e35a997eea08-004
https://ads.servenobid.com/sync?pid=321&uid=RX-2123905e-4908-47d5-ab08-e35a997eea08-004

0
361 B

356ms
356ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=321&uid=RX-2123905e-4908-47d5-ab08-e35a997eea08-004
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=321&uid=RX-2123905e-4908-47d5-ab08-e35a997eea08-004
date: Thu, 13 Oct 2022 17:20:54 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX2123905e490847d5ab08e35a997eea08004
content-type: text/html

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=2018527436378046688

0
344 B

359ms
359ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=2018527436378046688
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=2018527436378046688
Date: Thu, 13 Oct 2022 17:20:54 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
https://ads.servenobid.com/sync?pid=332&uid=3bea9d4e-f12d-4b75-91b0-db72c0ac42dc

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ssp.disqus.com/redirectuser?partner=adaptmx&gdpr=1&gdpr_consent=&us_privacy=1YN-&r=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F4188%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3Dd...
https://prebid.a-mo.net/cchain/0/4188?gdpr=0&gdpr_consent=&us_privacy=1YN-&A=dd94df2c-8e1a-4ea6-a974-f32605671c7b&bidder=zeta&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&uid=...
https://cm.adform.net/cookie?gdpr=1&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F4188%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3Ddd94df2c-8e1a-4ea6-a974-f3260...
https://prebid.a-mo.net/cchain/2/4188?gdpr=0&gdpr_consent=&us_privacy=1YN-&A=dd94df2c-8e1a-4ea6-a974-f32605671c7b&bidder=adform&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&ui...
https://ads.servenobid.com/sync?pid=327&uid=dd94df2c-8e1a-4ea6-a974-f32605671c7b&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
356 B

357ms
356ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=dd94df2c-8e1a-4ea6-a974-f32605671c7b&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:57 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=dd94df2c-8e1a-4ea6-a974-f32605671c7b&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Thu, 13 Oct 2022 17:20:56 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A

0
366 B

356ms
356ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A
date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

204
No Content

pixel
ap.lijit.com/ Frame B363
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D6%26r%3DCid1YS05MGEzMGRlMi1hNGM0LTNlZjktYmQ4Ny1jMzQ2NTI1ZDdmMWYqU2h0dHBzOi8vYWRz...
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=1&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F1926%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3Ddd94df2...
https://prebid.a-mo.net/cchain/0/1926?gdpr=0&gdpr_consent=&us_privacy=&A=dd94df2c-8e1a-4ea6-a974-f32605671c7b&bidder=index_rtb&cbx=aHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzA1TU...
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F1926%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3Ddd94df2c-8e1a-4ea6-a974-f32605671c7b%26bidder%3Dappnexus%26cbx%3DaHR...
https://prebid.a-mo.net/cchain/2/1926?gdpr=0&gdpr_consent=&us_privacy=&A=dd94df2c-8e1a-4ea6-a974-f32605671c7b&bidder=appnexus&cbx=aHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzA1TUd...
https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F1926%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3Ddd94df2c-8e1a-4ea6-a974-f32605...

0
277 B

759ms
254ms

Image
text/plain

209.191.163.210

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F1926%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3Ddd94df2c-8e1a-4ea6-a974-f32605671c7b%26bidder%3Dsovrn%26cbx%3DaHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzA1TUdFek1HUmxNaTFoTkdNMExUTmxaamt0WW1RNE55MWpNelEyTlRJMVpEZG1NV1lxVTJoMGRIQnpPaTh2WVdSekxuTmxjblpsYm05aWFXUXVZMjl0TDNONWJtTV9jR2xrUFRNME5pWjFhV1E5ZFdFdE9UQmhNekJrWlRJdFlUUmpOQzB6WldZNUxXSmtPRGN0WXpNME5qVXlOV1EzWmpGbU1nRUdPQUU9JmJ1eWVydWlkPQ%253D%253D%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Server: 209.191.163.210 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 13 Oct 2022 17:20:57 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

Redirect headers

location: https://ap.lijit.com/pixel?gdpr=1&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F1926%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3Ddd94df2c-8e1a-4ea6-a974-f32605671c7b%26bidder%3Dsovrn%26cbx%3DaHR0cHM6Ly9zc3AuZGlzcXVzLmNvbS9tYXRjaD9iaWRkZXI9NiZyPUNpZDFZUzA1TUdFek1HUmxNaTFoTkdNMExUTmxaamt0WW1RNE55MWpNelEyTlRJMVpEZG1NV1lxVTJoMGRIQnpPaTh2WVdSekxuTmxjblpsYm05aWFXUXVZMjl0TDNONWJtTV9jR2xrUFRNME5pWjFhV1E5ZFdFdE9UQmhNekJrWlRJdFlUUmpOQzB6WldZNUxXSmtPRGN0WXpNME5qVXlOV1EzWmpGbU1nRUdPQUU9JmJ1eWVydWlkPQ%253D%253D%26uid%3D%24UID
date: Thu, 13 Oct 2022 17:20:56 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame B363
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ads.servenobid.com/sync?pid=339&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A

0
366 B

357ms
357ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A
date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame FCF5 0
747 B 236ms
236ms Script
text/html 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
AN-X-Request-Uuid: 51669e43-577e-41e3-9db4-f874d37f8bca
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15800414599134980761/300x250/ Frame C646 12 KB
3 KB 170ms
170ms Document
text/html 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ccb3832b3d97b3a175b80d46ff276b4effba91eeb395d9656b8bae06292beb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 45082
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2903
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 04:49:32 GMT
expires: Fri, 13 Oct 2023 04:49:32 GMT
last-modified: Wed, 14 Jul 2021 20:03:32 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5F45 0
566 B 516ms
175ms Ping
image/gif 172.253.118.154

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvz29ary_vlhg2RjvN6jThbbecO3_SBss_q3QrEDn-onrpxnDEQkWzSVekCMx7wQrwMmA3xUfmMswPoCZ4WM8XdoDsdxpimDa-qsPLU2HCbHDxbMc7CJ_IBcfLqmyMktrhskjFLAP8mjnFyoE2Xj_XhKA&sai=AMfl-YRnBK-HIiVamkefZRHkFGCd0NUOqAOhKfspn-Rur1u7hn441oqQDTqMABHL97xaoLVTc-aOTcuRe7QuxvvxK9IpK_i6PsA_tJgLjTTy&sig=Cg0ArKJSzP7IoGRSqw8-EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=666&cbvp=1&cstd=661&cisv=r20221012.21647&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.154 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15238862688899032776/728x90/ Frame 5116 12 KB
3 KB 200ms
199ms Document
text/html 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd81416585ab6f6dff0cfa057886843b0f8db19460cc71909dca4592f3bd96ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2975
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:54 GMT
expires: Fri, 13 Oct 2023 17:20:54 GMT
last-modified: Wed, 09 Mar 2022 03:58:45 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1C44 0
63 B 470ms
175ms Ping
image/gif 172.253.118.154

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu-MJgFYf1grfeR1jUM6K7LC63NBaFdW4ozlRIufcTeb6TYwBK7QladWHnUmYZoPkHqPnvmSzN6AfJSWl7z5hIP3jcU4f1ws9ymUevhV9Cwoc7r7rypgwYkFuDNK4QjtqK_7zoTrXkPxN6MPpwT6wuSgA&sai=AMfl-YSYPyDmWG2VQaFM9bTFhUWi2OuCF_QqO3GmlN9bdudG0Mae8iz4UGyo_OtE0O8leue5es9IZsJY4MS1EMt0BMZTACOWm8aVpRzyyONP&sig=Cg0ArKJSzPPBBwSsHA6kEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=829&cbvp=1&cstd=827&cisv=r20221012.01716&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.154 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame B486
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L97BUHYP-E-E5FX

0
142 B

269ms
269ms

Image
text/plain

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L97BUHYP-E-E5FX
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 5AF9D88DFC544DB1854047C206CBA771 Ref B: MEL01EDGE1507 Ref C: 2022-10-13T17:20:54Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXq7btZUQaBdIonVsUhVg==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L97BUHYP-E-E5FX
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B486
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTE3NTJjYjllN2M5NDY1MGZhMjMxZGRiNzQyY2MwYWVjNzMyOWRhYQ

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTE3NTJjYjllN2M5NDY1MGZhMjMxZGRiNzQyY2MwYWVjNzMyOWRhYQ

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTE3NTJjYjllN2M5NDY1MGZhMjMxZGRiNzQyY2MwYWVjNzMyOWRhYQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4b9b5fe4fdc8ed94e0f7cdc225df187a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame B486 43 B
855 B 1584ms
433ms Image
image/gif 52.95.126.138

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.126.138 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: EWN7G75CEK2Q1CKWJQJ7
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B486
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI28PGo8XqrMwhCgTAs61gE&google_cver=1

42 B
690 B

173ms
172ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI28PGo8XqrMwhCgTAs61gE&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI28PGo8XqrMwhCgTAs61gE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B486
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=&expires=30

42 B
690 B

170ms
170ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=&expires=30
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B486
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDk3QlVIWVAtRS1FNUZY

170 B
188 B

175ms
174ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDk3QlVIWVAtRS1FNUZY

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDk3QlVIWVAtRS1FNUZY
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B486
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=8CQZhrsORcybvm-WwCV2mg&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=8CQZhrsORcybvm-WwCV2mg

43 B
479 B

298ms
298ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=8CQZhrsORcybvm-WwCV2mg

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 7XNH2DMZ19KRCEHJ1S1G
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=8CQZhrsORcybvm-WwCV2mg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d335433bbbe0efeac67146df47932f6f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B486
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/JafUz5K_gX0J05OriR8MJA?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5533403771467033879

42 B
678 B

172ms
171ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5533403771467033879
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5533403771467033879
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame BD8B 91 KB
23 KB 347ms
347ms Script
application/javascript 18.155.145.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.145.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-145-129.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 107d9675170d96f52a4921f960f44e7c.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-P1
age: 1907078
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: AANObAOjYBAQQ1g4KMgbACnWFiERdS_HfMIE_AujurtgwwAhDvfIcQ==

GET
H2 200 mon
pixel.adsafeprotected.com/ Frame 5F45 43 B
216 B 179ms
178ms Image
image/gif 52.221.37.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=10933&advId=1008917700&campId=18563143810&pubId=1&chanId=881479034793&placementId=445254004&dealId=&adsafe_par&impId=ABAjH0ivbhIJmEdEtPQSupELnbYe&bidurl=https://www.bg3.co/a/fu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&adsafe_url=https%3A%2F%2Fwww.bg3.co%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:a628b20e-f7ef-ceda-576c-0fced4b83d28,c:qWFQqn,sl:na,em:true,fr:false,thd:1,mn:jsserver-primary-5b77d768f7-66hbv,rg:sg,pt:1-5-15,mu:10000,br:c,bru:c,an:n,oam:0,scm:publ1.grpm1,mtim:731,mot:0,app:0,maw:0,fm:tkait0r+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:748,oid:62dd1743-4b1b-11ed-926a-8ef7070878f1,v:19.8.355,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.221.37.40 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-221-37-40.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: app02.sg.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 293ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=bec59399-84d1-ed6a-fb82-930da26a5b4b&tv=%7Bc:qWFQqC,pingTime:-2.1,time:2136,type:a,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:2136,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B2130~0%5D,as:%5B2130~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:304,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.1193990-66063503%7C161%7C162%7C17.1193990-66063505%7C171%7C172%7C173%7C181%7C182%7C19%7C1a,idMap:16.a628b20e-f7ef-ceda-576c-0fced4b83d28.20_10933%7C16*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:22,sinceFw:47,readyFired:false,sis:374%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 294ms
294ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=a628b20e-f7ef-ceda-576c-0fced4b83d28&tv=%7Bc:qWFQqI,pingTime:-3,time:769,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:748%7D,%7Bpiv:0,vs:o,r:l,t:769%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:769,n:769,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:747,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~1,0~0%5D,as:%5B38~300.250%5D%7D%7D,%7Bsl:o,t:769,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B0~0%5D,as:%5B0~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkait0r+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:748%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 294ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=a628b20e-f7ef-ceda-576c-0fced4b83d28&tv=%7Bc:qWFQqJ,pingTime:-6,time:770,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:770,n:769,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:747,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~1,0~0%5D,as:%5B38~300.250%5D%7D%7D,%7Bsl:o,t:769,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkait0r+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:748%7D&tpiLookup=ao:www.bg3.co*&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 sync
ads.servenobid.com/ Frame FE7D 0
344 B 357ms
356ms Image
image/avif 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=6515904591762493634&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET smart
sync.adotmob.com/cookie/ Frame FE7D 0
0

GET
H2

200

/
rtb-csync.smartadserver.com/redir/ Frame FE7D
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=f49d8ee4

43 B
319 B

176ms
169ms

Image
image/gif

23.106.127.52
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=f49d8ee4
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Server: 23.106.127.52 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date: Thu, 13 Oct 2022 17:20:54 GMT
via: 1.1 2e665350ce36612d432303ac51dbf21a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN2-P2
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=f49d8ee4
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: ua_HUr4c7wLRjcgl3--s_P970qV7PxHiS5txhElL2B_0EXEd_cmRRg==

GET
H2

200

/
rtb-csync.smartadserver.com/redir/ Frame FE7D
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7154048233776871579&gdpr=0&gdpr_consent=

43 B
343 B

170ms
169ms

Image
image/gif

23.106.127.52
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7154048233776871579&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Server: 23.106.127.52 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7154048233776871579&gdpr=0&gdpr_consent=
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3 200 711890.gif
id.rlcdn.com/ Frame FE7D 42 B
60 B 277ms
277ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711890.gif?credir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D136%26partneruserid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 292ms
291ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=a628b20e-f7ef-ceda-576c-0fced4b83d28&tv=%7Bc:qWFQr2,pingTime:0,time:789,type:pf,im:%7Bsf:0%7D,sca:%7Bdfp:%7Bdf:3,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:748%7D,%7Bpiv:0,vs:o,r:l,t:769%7D,%7Bpiv:100,vs:i,r:,t:789%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1,o:788,n:769,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:747,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~1,0~0%5D,as:%5B38~300.250%5D%7D%7D,%7Bsl:o,t:769,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B20~0%5D,as:%5B20~300.250%5D%7D%7D,%7Bsl:i,t:788,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B0~100%5D,as:%5B0~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C17.10933%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16.bec59399-84d1-ed6a-fb82-930da26a5b4b.21_1193990-66063503%7C16*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:748%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 292ms
292ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=a628b20e-f7ef-ceda-576c-0fced4b83d28&tv=%7Bc:qWFQr5,pingTime:-2,time:792,type:a,im:%7Bpom:1,prf:%7BbeA:3152,beZ:3153,mfA:3883,cmA:3883,inA:3883,inZ:3884,prA:3884,prZ:3897,si:3900,poA:3900,poZ:3909,cmZ:3909,mfZ:3909,loA:3922,loZ:3924,ltA:3944,ltZ:3944,mdA:3153,mdZ:3809%7D%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:748%7D,%7Bpiv:0,vs:o,r:l,t:769%7D,%7Bpiv:100,vs:i,r:,t:789%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:4,o:788,n:769,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:747,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~1,0~0%5D,as:%5B38~300.250%5D%7D%7D,%7Bsl:o,t:769,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B20~0%5D,as:%5B20~300.250%5D%7D%7D,%7Bsl:i,t:788,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B3~100%5D,as:%5B3~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:0,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C17.10933%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16.bec59399-84d1-ed6a-fb82-930da26a5b4b.21_1193990-66063503%7C16*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:748,sinceFw:44,readyFired:true%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 css
fonts.googleapis.com/ Frame C646 2 KB
470 B 172ms
170ms Stylesheet
text/css 172.253.118.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Judson:400,700&display=swap

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b353cf7828fd9c163e8083f15eb126cee2ed4068de963d6e010e64dbfd3be010

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 17:20:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 13 Oct 2022 17:20:54 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ Frame C646 85 KB
30 KB 738ms
173ms Script
text/javascript 74.125.200.95

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.95 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 10:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 282503
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Oct 2023 10:52:31 GMT

GET
H3 200 blur_bg.jpg
s0.2mdn.net/sadbundle/15800414599134980761/300x250/ Frame C646 4 KB
4 KB 171ms
170ms Image
image/jpeg 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/blur_bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

783dca8cea5225452f53deffaee8af4aeb01f9c5bce9ee5e8b29df72779ed6b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:49:35 GMT
x-content-type-options: nosniff
age: 45079
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4539
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 20:03:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 04:49:35 GMT

GET
H3 200 main_bg.jpg
s0.2mdn.net/sadbundle/15800414599134980761/300x250/ Frame C646 43 KB
43 KB 171ms
170ms Image
image/jpeg 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/main_bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c222ac92c0bf952748ad18f2ea514f8fd4e08812a7d6a20dab6aeab503212c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:49:36 GMT
x-content-type-options: nosniff
age: 45078
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44435
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 20:03:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 04:49:36 GMT

GET
H3 200 tagline.png
s0.2mdn.net/sadbundle/15800414599134980761/300x250/ Frame C646 7 KB
7 KB 171ms
170ms Image
image/png 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/tagline.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0bec03ef45f4ed2d4a98c121b3241025be320a2c1961b3130509e09b73b0b11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:49:38 GMT
x-content-type-options: nosniff
age: 45076
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7209
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 20:03:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 04:49:38 GMT

GET
H3 200 tagline2.png
s0.2mdn.net/sadbundle/15800414599134980761/300x250/ Frame C646 3 KB
3 KB 170ms
170ms Image
image/png 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/tagline2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

440f764a704a1634d5bb4424b2b5caa24708490f024bcc1f38f0527a28aeb980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:49:38 GMT
x-content-type-options: nosniff
age: 45077
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3154
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 20:03:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 04:49:38 GMT

GET
H3 200 logo-white.png
s0.2mdn.net/sadbundle/15800414599134980761/300x250/ Frame C646 3 KB
3 KB 171ms
171ms Image
image/png 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/logo-white.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbaf4e291a4ce13deda8705361994a577047143419dc8aecbad6c783146dae92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15800414599134980761/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 04:49:38 GMT
x-content-type-options: nosniff
age: 45077
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3021
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 20:03:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 04:49:38 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 5116 2 KB
470 B 172ms
170ms Stylesheet
text/css 172.253.118.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Judson:400,700&display=swap

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b353cf7828fd9c163e8083f15eb126cee2ed4068de963d6e010e64dbfd3be010

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 17:20:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 13 Oct 2022 17:20:54 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ Frame 5116 85 KB
30 KB 851ms
361ms Script
text/javascript 74.125.200.95

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.95 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 10:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 282503
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Oct 2023 10:52:31 GMT

GET
H3 200 blur_bg.jpg
s0.2mdn.net/sadbundle/15238862688899032776/728x90/ Frame 5116 5 KB
5 KB 173ms
172ms Image
image/jpeg 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/blur_bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa08718b4a8a52c6817a88fc413d0cbda160e059f7ff17b2cbd97470ff0738ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5406
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 03:58:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 17:20:54 GMT

GET
H3 200 main_bg.jpg
s0.2mdn.net/sadbundle/15238862688899032776/728x90/ Frame 5116 52 KB
52 KB 253ms
252ms Image
image/jpeg 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/main_bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2c2657dd3cf52213807ea381281a9ecd857828c163764fe040c0ac9532defb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53409
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 03:58:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 17:20:54 GMT

GET
H3 200 tagline1.png
s0.2mdn.net/sadbundle/15238862688899032776/728x90/ Frame 5116 5 KB
5 KB 203ms
203ms Image
image/png 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/tagline1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0a54c140b7743688e34987da9c14cc70f01311707295379e16e9f11272e45fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5418
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 03:58:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 17:20:55 GMT

GET
H3 200 tagline2.png
s0.2mdn.net/sadbundle/15238862688899032776/728x90/ Frame 5116 4 KB
4 KB 172ms
172ms Image
image/png 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/tagline2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b299e2fd5f1699e071f19591125d6c816b2d21af702eb3754dc608e1bf925355

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3827
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 03:58:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 17:20:55 GMT

GET
H3 200 logo-white.png
s0.2mdn.net/sadbundle/15238862688899032776/728x90/ Frame 5116 3 KB
3 KB 172ms
171ms Image
image/png 172.253.118.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/logo-white.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbaf4e291a4ce13deda8705361994a577047143419dc8aecbad6c783146dae92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15238862688899032776/728x90/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3021
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 03:58:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 13 Oct 2023 17:20:55 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1C44 42 B
64 B 192ms
190ms Fetch
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvUatWj3Z6PQp-_tgkAecbTsLjB2kpsL5gOU28-jCSVycHP5W1KKFGL1nJPaTaxvk9vlXMnVF4422BaRl6WQOTyDDtqKLeardWuQvP0VWOTYTZFWOEOrXcDnvlc3jr0cKhVrJo&sai=AMfl-YTxrXirQgPUhPKcgubqV0H8KgVi6bG30hokP4eGbWGa_9BIGMzjamJL3sT6gJwm2Mt0ltKRVa-FonJ9NeKrOFk-UHdAzlQmYvGD8zkIAIvGGrnzHr2apaHzAdUAbAc&sig=Cg0ArKJSzBK3LvYshAmKEAE&cid=CAASJeRoPhpJ0uc6emOpZYOCHjqRiuSqRD10mNdd4XJRxq7dNfi7Wgo&id=lidar2&mcvt=1006&p=1110,436,1200,1164&mtos=209,1006,1006,1006,1006&tos=209,797,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2857874404&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665681650201&rpt=3039&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 642E
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABg9JdAqVJPBXEuehCyl08Ogcm8iNlRZDLdA

170 B
188 B

174ms
173ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABg9JdAqVJPBXEuehCyl08Ogcm8iNlRZDLdA

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABg9JdAqVJPBXEuehCyl08Ogcm8iNlRZDLdA
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 200 711916.gif
id.rlcdn.com/ Frame 642E 42 B
60 B 275ms
269ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711916.gif?ct=4&cv=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=36aa6348-48f5-4500-aff1-c310f4e27d19&gdpr=0&gdpr_consent=

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=36aa6348-48f5-4500-aff1-c310f4e27d19&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Thu, 13 Oct 2022 17:20:54 GMT
Server: MT3 4539 98cc2da master hkg-pixel-x8 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=36aa6348-48f5-4500-aff1-c310f4e27d19&gdpr=0&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 13 Oct 2022 17:20:53 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=2&uid=L97BUHYP-E-E5FX&gdpr=0

0
340 B

328ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=2&uid=L97BUHYP-E-E5FX&gdpr=0

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://onetag-sys.com/match/?int_id=2&uid=L97BUHYP-E-E5FX&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=8445328433425422172

0
340 B

329ms
329ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=8445328433425422172

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
AN-X-Request-Uuid: fbba4abd-5572-455f-b34d-8fe2414a495f
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=8445328433425422172
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 642E 42 B
690 B 250ms
171ms Image
image/gif 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=mBsGxzC2fVPwwbXS1_6_Mz7oOA9uAKWG6MF6o4PPmPE
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 38ddff6a66d3988dfd0c6ea3be81c5f1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1YN-&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
https://onetag-sys.com/match/?int_id=107&uid=6515904591762493634

0
340 B

327ms
327ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=107&uid=6515904591762493634

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=107&uid=6515904591762493634
date: Thu, 13 Oct 2022 17:20:53 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 642E
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=lqFB43dDa0z16diYap4Ab-ssEJKWlMhlmuuSqf3tvHU

43 B
479 B

380ms
307ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=lqFB43dDa0z16diYap4Ab-ssEJKWlMhlmuuSqf3tvHU

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 0316TSTVG0PRZ9GSXETQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=lqFB43dDa0z16diYap4Ab-ssEJKWlMhlmuuSqf3tvHU
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID&rdf=1
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=ODI3N0NGNkUtMEM4OC00QTIyLTgyMUMtN0M3QUMyMTQyQ0Y3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESELsqXW36BaquXgc6kwNRL1c&google_cver=1

0
340 B

328ms
327ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESELsqXW36BaquXgc6kwNRL1c&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESELsqXW36BaquXgc6kwNRL1c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=92&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A

0
340 B

327ms
327ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=92&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=92&uid=y-0OQIJ0VE2uHRo43j2UqpW1cEfU.W13YJ8TlVbFs-~A
date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=

0
340 B

329ms
325ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/match/?int_id=29&uid=e4975f9d-6af1-4332-8a0f-f48771004dc1&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 233

GET
H2

200

/
onetag-sys.com/match/ Frame 642E
Redirect Chain

https://x.bidswitch.net/sync?ssp=onetag&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=onetag&bsw_param=51156692-b53f-4d50-a156-5b806a4b8444&google_hm=NTExNTY2OTItYjUzZi00ZDUwLWExNTYtNWI4MDZhNGI4NDQ0
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESECAu_5oJpWZ0C1O7PyKpS54&google_cver=1&ssp=onetag&bsw_param=51156692-b53f-4d50-a156-5b806a4b8444
https://onetag-sys.com/match/?int_id=30&uid=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=&gdpr_consent=&us_privacy=

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=30&uid=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=&gdpr_consent=&us_privacy=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location: //onetag-sys.com/match/?int_id=30&uid=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=&gdpr_consent=&us_privacy=
Date: Thu, 13 Oct 2022 17:20:54 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 642E 0
365 B 367ms
358ms Image
image/avif 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=318&uid=mBsGxzC2fVPwwbXS1_6_Mz7oOA9uAKWG6MF6o4PPmPE
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C963 5 KB
6 KB 707ms
192ms Script
text/html 103.231.98.196

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=28547515&p=159463&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.196 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a2dd29b5b77a2e5850f79d29d9a03c29624859533d0356fedc363d18da8dca2c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 13 Oct 2022 17:20:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 293ms
292ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1193990&asId=bec59399-84d1-ed6a-fb82-930da26a5b4b&tv=%7Bc:qWFQuz,pingTime:-10,time:2381,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODkuMC40Mzg5LjcyIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1665681653441%7C%7Cc69b1f429c905f2297e612146c5a6ea4%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C10aa99c0a1a28160c78a061a626af507%7C%7Cd348734c93e947fd19248375e2f0ff66%7C%7Cd1621bf054480c748d5d35a70f41eec0%7C%7C703f6f2eba516ac769d151306e802804%7C%7C727c9b0ee3bbd9dfb743e1b4f66084af%7C%7C1663701684,sca:%7Bspg:c07b1487-ffc3-0027-d04b-13e18e1489e6%7D%7D
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: nginx
x-server-name: dt02.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5F45 42 B
64 B 182ms
182ms Fetch
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsssqOx3ImOh2Kvq1ORXRj4HXXovyWCOBlZlppwEPa70VMEn1WfbcnC8W8HQ1blpsE4-xLb6wokzrToFDQ6--0yKH5AIzYnmd-k7M8nwhSRf_CrumYAjDntCMy6nEZp6NQSRrj4&sai=AMfl-YRZKi0FHgpRGDBmysuoeI6kypxSY5ZTwZxar1zmMVWzDpAmvZQIThyvf0oskzl9ej2kBwcnxkSAIowTGvNzrWnkHRtGaFPdA5ZjEX38oxyXMpv0KTjvF9sl0_3B8jc&sig=Cg0ArKJSzATa-ONNvAKJEAE&cid=CAASJeRoZqdY8NualZ4IFFxajYcnzvtrbSnLv5ag-nqLdBTXPg3wPDU&id=lidar2&mcvt=1000&p=60,450,310,750&mtos=338,1000,1000,1000,1000&tos=338,662,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1420297610&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665681650191&rpt=3171&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-136-93-127.ap-southeast-1.compute.amazonaws.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 175A 43 B
855 B 296ms
296ms Image
image/gif 52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XRM416E2CSZT91BPYR5P
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 175A
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e4975f9d-6af1-4332-8a0f-f48771004dc1&expiration=1668273654&gdpr=0&gdpr_consent=

43 B
766 B

888ms
296ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e4975f9d-6af1-4332-8a0f-f48771004dc1&expiration=1668273654&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e4975f9d-6af1-4332-8a0f-f48771004dc1&expiration=1668273654&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 175A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESELWVEMRPZMcJNhK8mWrbYx4&google_cver=1

43 B
880 B

453ms
291ms

Image
image/gif

104.18.18.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESELWVEMRPZMcJNhK8mWrbYx4&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.18.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QVCG6SkskTPN6fGHLLnbDHHzx777Lhy3mJqqke0AIFpn8tXGq2skNNJuMDO2oN5OJJpQRqDifcqdEXjrytdLrWnSg2xzQC%2Bg6As%2F1xjSAmEIWApOHhI5Pa89JQ3Tx%2FBwt3N51%2FtM5OQITQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 7599bfa66f395ac4-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESELWVEMRPZMcJNhK8mWrbYx4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 175A 43 B
601 B 179ms
175ms Image
image/gif 18.136.93.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.136.93.127 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 175A
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABgeU7GkJIAAB_pQuo11g&expiration=1666891255

43 B
766 B

282ms
281ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABgeU7GkJIAAB_pQuo11g&expiration=1666891255
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABgeU7GkJIAAB_pQuo11g&expiration=1666891255
Date: Thu, 13 Oct 2022 17:20:55 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame 175A
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=b9da57ac-3cf4-ce0a-3385a79f

43 B
766 B

934ms
281ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=b9da57ac-3cf4-ce0a-3385a79f
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

date: Thu, 13 Oct 2022 17:20:54 GMT
via: 1.1 google
server: nginx/1.22.0
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=b9da57ac-3cf4-ce0a-3385a79f
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 175A 42 B
181 B 592ms
180ms Image
image/gif 18.136.185.21

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.136.185.21 -, , ASN (),
Reverse DNS
Software: nginx/1.20.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.20.0
content-length: 42
vary: Cookie
content-type: image/gif

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 175A
Redirect Chain

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&prevuid=07030001_634848f6dc13d&knw=0
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=07030001_634848f6dc13d

43 B
766 B

523ms
297ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=07030001_634848f6dc13d
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=07030001_634848f6dc13d
content-type: text/html; charset=UTF-8
cache-control: no-cache
keep-alive: timeout=10
access-control-allow-headers: Origin

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 175A 43 B
350 B 431ms
90ms Image
image/gif 104.18.13.76

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y0hI8-reWr55Dv7cRZankQAA%265004
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.13.76 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 0
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 7599bfa668543773-MEL
content-length: 43
expires: Thu, 13 Oct 2022 19:20:54 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 43EB
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8445328433425422172

43 B
766 B

885ms
295ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8445328433425422172
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
AN-X-Request-Uuid: 5fba0a28-c54b-42cf-9399-dba7aaa76076
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8445328433425422172
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 43EB
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=36aa6348-48f5-4500-aff1-c310f4e27d19

43 B
766 B

843ms
281ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=36aa6348-48f5-4500-aff1-c310f4e27d19
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Date: Thu, 13 Oct 2022 17:20:54 GMT
Server: MT3 4539 98cc2da master hkg-pixel-x21 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=36aa6348-48f5-4500-aff1-c310f4e27d19
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 13 Oct 2022 17:20:53 GMT

GET
H2

200

Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 43EB
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB

43 B
601 B

175ms
175ms

Image
image/gif

18.136.93.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Server

18.136.93.127 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-136-93-127.ap-southeast-1.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB
date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 43EB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=Y0hI9gAAAzAPfAAB
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y0hI9gAAAzAPfAAB&_test=Y0hI9gAAAzAPfAAB

43 B
766 B

432ms
282ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y0hI9gAAAzAPfAAB&_test=Y0hI9gAAAzAPfAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-mel11254-MEL
pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1665681655.097857,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y0hI9gAAAzAPfAAB&_test=Y0hI9gAAAzAPfAAB
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 43EB
Redirect Chain

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y0hI8-reWr55Dv7cRZankQAA%265004?gdpr_consent=&us_privacy=&gdpr=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y0hI8-reWr55Dv7cRZankQAA%265004

42 B
942 B

174ms
174ms

Image
image/gif

122.248.254.251

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y0hI8-reWr55Dv7cRZankQAA%265004

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

HTTP/1.1

Server

122.248.254.251 -, , ASN (),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-apse-1-v041-0fbfcff88.edge-apse.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: hpFEsBdHSqU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-apse-1-v041-0e594cc9c.edge-apse.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: ZjFJqfnQQMA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y0hI8-reWr55Dv7cRZankQAA%265004
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 43EB 43 B
601 B 182ms
174ms Image
image/gif 18.136.93.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.136.93.127 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-136-93-127.ap-southeast-1.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 43EB
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e4975f9d-6af1-4332-8a0f-f48771004dc1&expiration=1668273654&gdpr=0&gdpr_consent=

43 B
766 B

888ms
296ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e4975f9d-6af1-4332-8a0f-f48771004dc1&expiration=1668273654&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e4975f9d-6af1-4332-8a0f-f48771004dc1&expiration=1668273654&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 43EB
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=3uJlXjr31OJ1T85

43 B
766 B

848ms
282ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=3uJlXjr31OJ1T85
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:53 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/5502e06#5502e06d7dbe3c52c9a5559e1550ac262fba6e07 i-062a250e8c9e3d8af@ap-southeast-1b@dxedge-app-ap-southeast-1-prod-asg
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=3uJlXjr31OJ1T85
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 43EB 0
356 B 362ms
356ms Image
image/avif 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=Y0hI8_reWr55Dv7cRZankQAAE4wAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame A838 31 KB
10 KB 351ms
351ms Script
text/html 184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 116f5d8b824fc3d431bfcd8537915e4a8ad7683fa5580cf4314bbc91cfccd95a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:54 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Sep 2022 22:38:47 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=17806
Connection: keep-alive
Content-Length: 9422
Expires: Thu, 13 Oct 2022 22:17:40 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E4F5 31 KB
10 KB 317ms
315ms Script
text/html 184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 116f5d8b824fc3d431bfcd8537915e4a8ad7683fa5580cf4314bbc91cfccd95a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=medianet
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 13 Oct 2022 17:20:54 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Sep 2022 22:38:47 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=17806
Connection: keep-alive
Content-Length: 9422
Expires: Thu, 13 Oct 2022 22:17:40 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=8445328433425422172

35 B
250 B

1135ms
240ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=8445328433425422172
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:54 GMT
AN-X-Request-Uuid: 91fe573c-8760-4290-852d-fa20d1f8300f
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://usersync.gumgum.com/usersync?b=apn&i=8445328433425422172
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_117dc04a-d8cb-4f40-aab7-c78a3be7cae0&gdpr=0&gdpr_consent=&us_privacy=1---
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=9aac76fe-d180-4534-b2b5-1906d980f90d&ssp=gumgum2
https://usersync.gumgum.com/usersync?b=bsw&i=51156692-b53f-4d50-a156-5b806a4b8444

35 B
250 B

242ms
241ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=51156692-b53f-4d50-a156-5b806a4b8444
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=51156692-b53f-4d50-a156-5b806a4b8444
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET

pixelSync
pixel-sync.sitescout.com/dmp/ Frame 1FBB
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28NUmVj4QInyq3222zkBh7b8FEVTEA0soz861kBepegPuq0xCKXWGSmzGCK2qkC55E%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=a_117dc04a-d8cb-4f40-aab7-c78a3be7cae0&obuid=ENC(NUmVj4QInyq3222zkBh7b8FEVTEA0soz861kBepegPuq0xCKXWGSmzGCK2qkC55E)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=127&gdpr=$GDPR_APPLIES&us_privacy=$CCPA&gdpr_consent=$CONSNT_STRING&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcentro%26uid%3D%7Bus...

0
0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=380c7a69-208d-4e9c-b72c-bcaba11180c7

35 B
250 B

1033ms
244ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=380c7a69-208d-4e9c-b72c-bcaba11180c7
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 13 Oct 2022 17:20:54 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=380c7a69-208d-4e9c-b72c-bcaba11180c7
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-07ce9018-e4ed-48d8-6627-82cb1920071c$ip$103.209.254.101

35 B
250 B

416ms
242ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-07ce9018-e4ed-48d8-6627-82cb1920071c$ip$103.209.254.101
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-07ce9018-e4ed-48d8-6627-82cb1920071c$ip$103.209.254.101
Date: Thu, 13 Oct 2022 17:20:55 GMT
Connection: keep-alive
Content-Length: 129
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-dz9gUYpE2pcakn7.JD.p2uU8vm.ifz6gqNfR~A

35 B
250 B

1186ms
242ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-dz9gUYpE2pcakn7.JD.p2uU8vm.ifz6gqNfR~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 13 Oct 2022 17:20:54 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-dz9gUYpE2pcakn7.JD.p2uU8vm.ifz6gqNfR~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=3fb2b45a-6110-448e-bf91-971eb490969b

35 B
250 B

418ms
241ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=3fb2b45a-6110-448e-bf91-971eb490969b
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=3fb2b45a-6110-448e-bf91-971eb490969b
Date: Thu, 13 Oct 2022 17:20:55 GMT
Connection: keep-alive
X-CI-RTID: a60ed46d-f50e-4d67-a22e-a5bfc16570c9
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 204 services
sync.technoratimedia.com/ Frame 1FBB 0
293 B 1095ms
362ms Image
text/plain 129.159.70.95

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 129.159.70.95 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 908332445
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame 1FBB 0
44 B 1093ms
344ms Image
text/plain 169.197.150.7

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 -, , ASN (),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
content-length: 0
server: c

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_117dc04a-d8cb-4f40-aab7-c78a3be7cae0&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=1GW7KOa8h2xsOMA8UhpQ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2MKHK43UWT3BHBUDE6DTJ5GUCOCVNBYFC...
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=1GW7KOa8h2xsOMA8UhpQ&us_privacy=1---

35 B
250 B

476ms
241ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=1GW7KOa8h2xsOMA8UhpQ&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=1GW7KOa8h2xsOMA8UhpQ&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=f3aaefa9-6ea7-4920-b06a-54b9cb92850a

35 B
250 B

531ms
242ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=f3aaefa9-6ea7-4920-b06a-54b9cb92850a
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=f3aaefa9-6ea7-4920-b06a-54b9cb92850a
access-control-allow-origin: *
date: Thu, 13 Oct 2022 17:20:55 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 1FBB
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-2123905e-4908-47d5-ab08-e35a997eea08-004&rndcb=3107521759
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=51156692-b53f-4d50-a156-5b806a4b8444&ssp=adconductor&gdpr=&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10521886487891375067&gdpr=&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vis...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=6596908a-1d49-48f2-a3b7-f80a06dcf3ed&ssp=adconductor&gdpr_consent=&gdpr=
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10521886487891375067&ssp=adconductor&gdpr=&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=231983304303011507567&ssp=adconductor&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10521886487891375067&ssp=adconductor&gdpr=&gdpr_consent=
https://sync.1rx.io/usersync/bidswitch/51156692-b53f-4d50-a156-5b806a4b8444?gdpr=&gdpr_consent=
https://sync.targeting.unrulymedia.com/csync/RX-2123905e-4908-47d5-ab08-e35a997eea08-004?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-2123905e-4908-47d5-ab08-e35a997eea08-004
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
127 B

190ms
190ms

Image
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:57 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 13 Oct 2022 17:20:56 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=Xx3hm5FRORdj&ev=1&pid=558355

35 B
250 B

519ms
243ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=Xx3hm5FRORdj&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
location: https://usersync.gumgum.com/usersync?b=pln&i=Xx3hm5FRORdj&ev=1&pid=558355
content-language: en-AU
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-58dbb47c57-nlvpr
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 1FBB
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=6515904591762493634

35 B
250 B

353ms
241ms

Image
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=6515904591762493634
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:56 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=6515904591762493634
date: Thu, 13 Oct 2022 17:20:55 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 1FBB 0
357 B 360ms
356ms Image
image/avif 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=a_117dc04a-d8cb-4f40-aab7-c78a3be7cae0
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 168ms
168ms Ping
text/plain 172.217.194.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Z0TZ7TDHS1&gtm=2oeaa0&_p=9989&cid=2069385963.1665681650&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1665681649&sct=1&seg=0&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Ffu-hao-yi-min-rang-da-lu-jing-ji-beng-kui-8cheng-wang-you-zhu-zhang-she-xian.html&dt=%E5%AF%8C%E8%B1%AA%E7%A7%BB%E6%B0%91%E8%AE%93%E5%A4%A7%E9%99%B8%E7%B6%93%E6%BF%9F%E5%B4%A9%E6%BD%B0%EF%BC%9F%E3%80%808%E6%88%90%E7%B6%B2%E5%8F%8B%E4%B8%BB%E5%BC%B5%E8%A8%AD%E9%99%90%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&en=link_preview&_ee=1&epn.value=1&epn.siteid=42753&ep.error_msg=no_mapping_failed&_et=3
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f139.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:54 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 01A4
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=36aa6348-48f5-4500-aff1-c310f4e27d19&gdpr=0&gdpr_consent=

35 B
250 B

926ms
239ms

Document
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=36aa6348-48f5-4500-aff1-c310f4e27d19&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:55 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:54 GMT
Expires: Thu, 13 Oct 2022 17:20:53 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4539 98cc2da master hkg-pixel-x4 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=36aa6348-48f5-4500-aff1-c310f4e27d19&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 0396
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=Y0hI9wAAAYQFRgAr
https://usersync.gumgum.com/usersync?b=atm&i=Y0hI9wAAAYQFRgAr&gdpr=0&gdpr_consent=&_test=Y0hI9wAAAYQFRgAr

35 B
250 B

562ms
241ms

Document
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=Y0hI9wAAAYQFRgAr&gdpr=0&gdpr_consent=&_test=Y0hI9wAAAYQFRgAr
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:55 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=Y0hI9wAAAYQFRgAr&gdpr=0&gdpr_consent=&_test=Y0hI9wAAAYQFRgAr
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mel11254-MEL
x-timer: S1665681655.346247,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame F63F 170 B
188 B 175ms
172ms Document
image/png 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV8xMTdkYzA0YS1kOGNiLTRmNDAtYWFiNy1jNzhhM2JlN2NhZTA=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Thu, 13 Oct 2022 17:20:54 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8EB1 15 KB
6 KB 331ms
329ms Document
text/html 104.65.228.208

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.228.208 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=39163
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 13 Oct 2022 17:20:54 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 14 Oct 2022 04:13:37 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 0FFA
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=e4975f9d-6af1-4332-8a0f-f48771004dc1

35 B
250 B

1014ms
242ms

Document
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=e4975f9d-6af1-4332-8a0f-f48771004dc1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:55 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Thu, 13 Oct 2022 17:20:54 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=e4975f9d-6af1-4332-8a0f-f48771004dc1
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 um Show response
cs.emxdgt.com/ Frame 90FF 0
66 B 293ms
293ms Document
text/plain 3.215.244.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.244.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-244-231.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 13 Oct 2022 17:20:54 GMT
server: awselb/2.0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F64F
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=Y0hI9cCo5sEAAIRmZxoAAAAA

35 B
250 B

898ms
242ms

Document
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=Y0hI9cCo5sEAAIRmZxoAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:55 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Thu, 13 Oct 2022 17:20:54 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=Y0hI9cCo5sEAAIRmZxoAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 21
X-SO-HostName: m-ad341.dc4p.scaleout.jp
X-SO-IP: 103.209.254.101
X-SO-Key: Y0hI9cCo5sEAAIRmZxoAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":21,"gdpr":false,"ipv4":"103.209.254.101","key":"Y0hI9cCo5sEAAIRmZxoAAAAA","privacy_sensitive":false,"uid":"Y0hI9cCo5sEAAIRmZxoAAAAA","upstream_id":"m-ad341"}
X-SO-LB-Hostname: a-tgng40003.dc2p.scaleout.jp
X-SO-UID: Y0hI9cCo5sEAAIRmZxoAAAAA
X-SO-Upstream-ID: m-ad341

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame C1E4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
https://usersync.gumgum.com/usersync?b=iex&i=Y0hI8-reWr55Dv7cRZankQAA%265004

35 B
250 B

866ms
242ms

Document
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=iex&i=Y0hI8-reWr55Dv7cRZankQAA%265004
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:55 GMT
Expires: 0
Pragma: no-cache

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7599bfa68f4e5ac4-MEL
content-length: 0
date: Thu, 13 Oct 2022 17:20:55 GMT
expires: 0
location: https://usersync.gumgum.com/usersync?b=iex&i=Y0hI8-reWr55Dv7cRZankQAA%265004
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LB6F63g3WRjTL5lN%2B0OvNRmNYTFy0Mc1yUJa4wS30kr8LBjtFyuq8NX3KA2ov82Vo%2FSI5Zjf5iQlOt4XTqQcJEm4SdmIOr94smFuXwXY4TGFTUBR9uq8IqkW%2BKv1m0BbqIowF5e7YzP2%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F30C
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=Ep1klExcaOT5PuXCE1YU&pi=gumgum&tc=1

35 B
250 B

240ms
239ms

Document
image/gif

54.238.120.71

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=Ep1klExcaOT5PuXCE1YU&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.238.120.71 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:56 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Thu, 13 Oct 2022 17:20:56 GMT Thu, 13 Oct 2022 17:20:56 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=Ep1klExcaOT5PuXCE1YU&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame E531
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

316ms
315ms

Document
text/html

184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 13 Oct 2022 17:20:55 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 13 Oct 2022 17:20:54 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 294ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQCE,pingTime:1,time:1631,type:p,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:582%7D,%7Bpiv:0,vs:o,r:l,t:606%7D,%7Bpiv:100,vs:i,r:,t:630%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1002,o:630,n:606,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:581,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B39~1,0~0%5D,as:%5B39~728.90%5D%7D%7D,%7Bsl:o,t:606,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B24~0%5D,as:%5B24~728.90%5D%7D%7D,%7Bsl:i,t:630,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:297,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16.10933%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17.c07b1487-ffc3-0027-d04b-13e18e1489e6.12_1193990-66063505%7C17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:583,sis:827%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 295ms
294ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQCF,pingTime:1,time:1632,type:c,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:582%7D,%7Bpiv:0,vs:o,r:l,t:606%7D,%7Bpiv:100,vs:i,r:,t:630%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1002,o:630,n:606,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:581,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B39~1,0~0%5D,as:%5B39~728.90%5D%7D%7D,%7Bsl:o,t:606,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B24~0%5D,as:%5B24~728.90%5D%7D%7D,%7Bsl:i,t:630,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:297,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16.10933%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17.c07b1487-ffc3-0027-d04b-13e18e1489e6.12_1193990-66063505%7C17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:583,sis:827,metricId:publ1,cmr:t%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 294ms
293ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQCG,pingTime:1,time:1633,type:c,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:582%7D,%7Bpiv:0,vs:o,r:l,t:606%7D,%7Bpiv:100,vs:i,r:,t:630%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1003,o:630,n:606,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:581,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B39~1,0~0%5D,as:%5B39~728.90%5D%7D%7D,%7Bsl:o,t:606,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B24~0%5D,as:%5B24~728.90%5D%7D%7D,%7Bsl:i,t:630,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1003~100%5D,as:%5B1003~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:297,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16.10933%7C161%7C162%7C163%7C1641%7C165%7C17*.10933%7C171%7C172%7C173%7C174%7C175%7C181%7C182%7C19%7C1a%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i1%7C1i2%7C1i3,idMap:17.c07b1487-ffc3-0027-d04b-13e18e1489e6.12_1193990-66063505%7C17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:583,sis:827,metricId:grpm1,cmr:t%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C44 43 B
215 B 292ms
292ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=7fa3bc7a-6408-12ef-a12d-74ca37b35dbb&tv=%7Bc:qWFQD9,pingTime:-10,time:1662,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODkuMC40Mzg5LjcyIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1665681653441%7C%7Cc69b1f429c905f2297e612146c5a6ea4%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7C10aa99c0a1a28160c78a061a626af507%7C%7Cd348734c93e947fd19248375e2f0ff66%7C%7Cd1621bf054480c748d5d35a70f41eec0%7C%7C703f6f2eba516ac769d151306e802804%7C%7C727c9b0ee3bbd9dfb743e1b4f66084af%7C%7C1663701684,sca:%7Bspg:c07b1487-ffc3-0027-d04b-13e18e1489e6%7D%7D
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
x-server-name: dt22.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame FCF5 0
747 B 230ms
229ms Script
text/html 104.254.151.60
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.60 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
AN-X-Request-Uuid: 39e12f77-b76c-4ada-b578-627fa76f100f
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 899.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame 06D6 35 B
467 B 202ms
201ms Document
image/gif 185.84.60.29
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 13 Oct 2022 17:20:55 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 8AC6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:36aa6348-48f5-4500-aff1-c310f4e27d19&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

191ms
189ms

Document
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame F612
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y0hI9wAAHNr91QA7&gdpr=0&gdpr_consent=&_test=Y0hI9wAAHNr91QA7
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

192ms
191ms

Document
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame B215
Redirect Chain

https://cm.ambientdsp.com/cm/send?vc=pmj
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQ0OSZ0bD00MzIwMA==&piggybackCookie=xf2ncvy8wdh
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

191ms
189ms

Document
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame 94EE
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=FQceWxcMTFMOUB0GQVEHVhECGlcOA0lREAK-p8DG
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

0
340 B

327ms
326ms

Document
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

content-length: 108
content-type: text/html; charset=utf-8
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame FA46
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sVhDpAGXA32b3lek9UhIYw

42 B
245 B

170ms
170ms

Document
image/gif

67.199.150.86

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sVhDpAGXA32b3lek9UhIYw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.86 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sVhDpAGXA32b3lek9UhIYw
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 324A
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

192ms
190ms

Document
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H/1.1 200
OK send Show response
sync-dsp.ad-m.asia/dsp/api/sync/ Frame 3AD6 43 B
243 B 806ms
206ms Document
image/gif 202.131.200.84

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-dsp.ad-m.asia/dsp/api/sync/send?s=pubmatic&rd=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyNTMmdGw9MTI5NjAw%26piggybackCookie%3D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 202.131.200.84 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: no-store,no-cache
Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:55 GMT
Pragma: no-cache
Server: nginx
expires: -1

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 80E8
Redirect Chain

https://ipac.ctnsnet.com/int/cm?exc=14&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA%3D%26piggybackCookie%3D%5Buser_id%5D
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=51637b7f764a4c8e9354b225d078c4f2
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

192ms
190ms

Document
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H/1.1 200
OK pxd Show response
dps.jp.cinarra.com/ Frame 4181 95 B
220 B 1048ms
240ms Document
image/png 54.238.44.253

General

Check archive.org

Show headers Download Go to

Full URL: https://dps.jp.cinarra.com/pxd?PLATFORM_ID=D&USER_ID=D4EE0202-C376-47CA-A8A6-1444CA23AF77
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.238.44.253 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 95
Content-Type: image/png
Date: Thu, 13 Oct 2022 17:20:55 GMT

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 899D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:3uJlXjr31OJ1T85&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

192ms
191ms

Document
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame DE77
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=655730d6-4b1b-11ed-8f99-aa43ecd44202

42 B
244 B

196ms
192ms

Document
image/gif

103.231.98.194

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=655730d6-4b1b-11ed-8f99-aa43ecd44202
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.194 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:55 GMT
Expires: Thu, 23 Sep 2004 17:42:04 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=655730d6-4b1b-11ed-8f99-aa43ecd44202
P3P: CP="NOI OTC OTP OUR NOR"
Pragma: no-cache
X-RealServer-NX: aws-apsoutheast1c-delivery-3
server: Cowboy

GET
H2

200

RX-2123905e-4908-47d5-ab08-e35a997eea08-004 Show response
sync.targeting.unrulymedia.com/csync/ Frame 7378
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-2123905e-4908-47d5-ab08-e35a997eea08-004&rndcb=5165978806
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=adconductor&bsw_custom_parameter=51156692-b53f-4d50-a156-5b806a4b8444
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=adconductor&bsw_custom_parameter=51156692-b53f-4d50-a156-5b806a4b8444
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=0a2a5147-bf37-465b-b283-bf3973cd1050&user_group=1&ssp=adconductor&bsw_param=51156692-b53f-4d50-a156-5b806a4b8444
https://sync.1rx.io/usersync/bidswitch/51156692-b53f-4d50-a156-5b806a4b8444?gdpr=&gdpr_consent=
https://sync.targeting.unrulymedia.com/csync/RX-2123905e-4908-47d5-ab08-e35a997eea08-004

43 B
377 B

179ms
179ms

Document
image/gif

74.118.186.45
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-2123905e-4908-47d5-ab08-e35a997eea08-004
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.118.186.45 Serangoon, Singapore, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-length: 43
date: Thu, 13 Oct 2022 17:20:57 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html
date: Thu, 13 Oct 2022 17:20:57 GMT
expires: 0
location: https://sync.targeting.unrulymedia.com/csync/RX-2123905e-4908-47d5-ab08-e35a997eea08-004
pragma: no-cache

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame D77B 43 B
281 B 1367ms
363ms Document
image/gif 195.5.165.20

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Thu, 13 Oct 2022 17:20:56 GMT
Vary: Accept-Encoding
X-adserver-worker: ragnarok-3030b51cc02f@version_1.528v3
X-core-time: 1ms
X-server-arch: v2

GET
H3 200 i.match Show response
a.tribalfusion.com/ Frame 632C 43 B
659 B 420ms
325ms Document
image/gif 172.64.152.245
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.152.245 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7599bfa8fe665aa0-MEL
content-length: 43
content-type: image/gif; charset=utf-8
date: Thu, 13 Oct 2022 17:20:55 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame CAA8 0
16 B 806ms
345ms Document
text/plain 169.197.150.7

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 -, , ASN (),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-length: 0
date: Thu, 13 Oct 2022 17:20:55 GMT
server: c

GET
H2 204 /
csync.loopme.me/ Frame 0322 0
0 559ms
361ms Document
text/plain 104.19.173.108

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.173.108 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7599bfa98bde5aac-MEL
date: Thu, 13 Oct 2022 17:20:55 GMT
server: cloudflare

GET
H2

200

rtb-h Show response
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 1540
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=29f7c2bf-53ba-448c-9f4f-0fcef8fab102-tucta41ce77&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
55 B

235ms
232ms

Document
text/plain

151.101.129.44

General

Check archive.org

Show headers Download Go to

Full URL: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=29f7c2bf-53ba-448c-9f4f-0fcef8fab102-tucta41ce77&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
content-length: 0
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mel11256-MEL
x-timer: S1665681655.468177,VS0,VE146

Redirect headers

accept-ranges: bytes
content-length: 0
date: Thu, 13 Oct 2022 17:20:55 GMT
location: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=29f7c2bf-53ba-448c-9f4f-0fcef8fab102-tucta41ce77&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mel11256-MEL
x-timer: S1665681655.281065,VS0,VE98
x-vcl-time-ms: 98

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame 2BB0 45 B
467 B 209ms
205ms Document
image/gif 23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3086832531539728000V10&type=pba&refUrl=&vid=56816532893086832531539728000V10&ovsid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 45
content-type: image/gif
date: Thu, 13 Oct 2022 17:20:55 GMT
expires: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame C963
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=1O4CAsN2R8qophREyiOvdw%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

13 KB
13 KB

324ms
323ms

Image
text/html

104.65.228.208

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 104.65.228.208 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=39162
accept-ranges: bytes
content-length: 5549
expires: Fri, 14 Oct 2022 04:13:37 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame C963
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77
https://pippio.com/api/sync?pid=5324&it=1&iv=ad7df01637a2f8115ba0da048c8b26ccb25d5d708ce6426a73d236b61999fb0c791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBhZDdkZjAxNjM3YTJmODExNWJhMGRhMDQ4YzhiMjZjY2IyNWQ1ZDcwOGNlNjQyNmE3M2QyMzZiNjE5OTlmYjBjNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBhZDdkZjAxNjM3YTJmODExNWJhMGRhMDQ4YzhiMjZjY2IyNWQ1ZDcwOGNlNjQyNmE3M2QyMzZiNjE5OTlmYjBjNzkxNDI2YjU0MTdkY2UyMRAAGgwI95GhmgYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=a5b7832b-d9b0-45e3-b088-970acd9b5b0e

42 B
60 B

274ms
273ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=a5b7832b-d9b0-45e3-b088-970acd9b5b0e
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:56 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=a5b7832b-d9b0-45e3-b088-970acd9b5b0e
date: Thu, 13 Oct 2022 17:20:56 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=36aa6348-48f5-4500-aff1-c310f4e27d19

0
260 B

500ms
170ms

Image
text/plain

67.199.150.85

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=36aa6348-48f5-4500-aff1-c310f4e27d19
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.85 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Thu, 13 Oct 2022 17:20:55 GMT
Server: MT3 4539 98cc2da master hkg-pixel-x19 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=36aa6348-48f5-4500-aff1-c310f4e27d19
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 13 Oct 2022 17:20:54 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame C963
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RDRFRTAyMDItQzM3Ni00N0NBLUE4QTYtMTQ0NENBMjNBRjc3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

Requested by

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

200

/
onetag-sys.com/match/ Frame C963
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMdfcYHV5B4XlUHUZa69OAU&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

Requested by

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-18-136-93-127.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2 200 pubmatic
um.simpli.fi/ Frame C963 43 B
612 B 520ms
169ms Image
image/gif 34.142.175.23

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.142.175.23 -, , ASN (),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 12 Oct 2022 17:20:55 GMT

GET
H2 200 D4EE0202-C376-47CA-A8A6-1444CA23AF77
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame C963 43 B
601 B 180ms
174ms Image
image/gif 18.136.93.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/D4EE0202-C376-47CA-A8A6-1444CA23AF77?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.136.93.127 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e4975f9d-6af1-4332-8a0f-f48771004dc1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
44 B

189ms
189ms

Image
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:56 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/
onetag-sys.com/match/ Frame C963
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8445328433425422172&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

0
340 B

327ms
326ms

Image
text/plain

51.79.234.101
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77

Requested by

Protocol

Server

51.79.234.101 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77
date: Thu, 13 Oct 2022 17:20:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6712601349632672716
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
44 B

197ms
196ms

Image
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8445328433425422172

42 B
113 B

326ms
325ms

Image
image/gif

103.231.98.194

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8445328433425422172
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 103.231.98.194 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Thu, 13 Oct 2022 17:20:55 GMT
AN-X-Request-Uuid: d2bc83d8-36c5-48cc-a0c3-e6e5e59659b0
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8445328433425422172
Connection: keep-alive
X-Proxy-Origin: 103.209.254.101; 103.209.254.101; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=283&user_id=a949cfc3-114a-4bda-908b-d8fe6b10b161&expires=1&user_group=5&ssp=pubmatic&bsw_param=51156692-b53f-4d50-a156-5b806a4b8444
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=51156692-b53f-4d50-a156-5b806a4b8444&gdpr=&gdpr_consent=&gdpr_pd=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
161 B

189ms
189ms

Image
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:56 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 13 Oct 2022 17:20:56 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=D4EE0202-C376-47CA-A8A6-1444CA23AF77&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-pClbvoFE2uVusXGjBYPLMLAzVD.9tUM-~A&gdpr=0&gdpr_consent=

0
48 B

520ms
171ms

Image
text/plain

67.199.150.85

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-pClbvoFE2uVusXGjBYPLMLAzVD.9tUM-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 67.199.150.85 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-pClbvoFE2uVusXGjBYPLMLAzVD.9tUM-~A&gdpr=0&gdpr_consent=
date: Thu, 13 Oct 2022 17:20:55 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4002404486759631747&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
44 B

197ms
196ms

Image
text/plain

103.231.98.197
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 103.231.98.197 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame C963
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=D4EE0202-C376-47CA-A8A6-1444CA23AF77&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=68fffb3c0ebd227f&is_secure=true&networkId=17100&version=1&nuid=D4EE0202-C376-47CA-A8A6-1444CA23AF77&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAALYlChoCbqpQNt3_oJAAAAAAA&expiration=1665768055&nuid=D4EE0202-C376-47CA-A8A6-1444CA23AF77&...

42 B
264 B

191ms
190ms

Image
image/gif

103.231.98.194

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAALYlChoCbqpQNt3_oJAAAAAAA&expiration=1665768055&nuid=D4EE0202-C376-47CA-A8A6-1444CA23AF77&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 103.231.98.194 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 13 Oct 2022 17:20:55 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAALYlChoCbqpQNt3_oJAAAAAAA&expiration=1665768055&nuid=D4EE0202-C376-47CA-A8A6-1444CA23AF77&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2 200 d1ba4609
rtb.gumgum.com/getuid/ Frame C963 35 B
209 B 768ms
243ms Image
image/gif 35.79.63.55

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3086832531539728000V10%26type%3Dpba%26refUrl%3D%26vid%3D56816532893086832531539728000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.79.63.55 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5F45 42 B
64 B 175ms
174ms Fetch
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstO24tGG56Ui_V7HMsH_wkCjApIq63UMCTHl4anVpJTumOk724gMz9KINoCIMvKNKffuIxuP1BexFiw-6mO8jVD-xZgWH4W&sig=Cg0ArKJSzFXh6PfGIPaWEAE&id=lidar2&mcvt=1017&p=0,0,250,300&mtos=1017,1017,1017,1017,1017&tos=1017,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=2228999113&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665681650191&rpt=3830&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-195-152-23.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame E4F5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=medianet&khaos=L97BUHYP-E-E5FX
https://contextual.media.net/cksync.php?type=rbcn&ovsid=L97BUHYP-E-E5FX

45 B
451 B

199ms
199ms

Image
image/gif

23.195.152.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=rbcn&ovsid=L97BUHYP-E-E5FX

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet

Protocol

Server

23.195.152.23 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 13 Oct 2022 17:20:55 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Thu, 13 Oct 2022 17:20:55 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://contextual.media.net/cksync.php?type=rbcn&ovsid=L97BUHYP-E-E5FX
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
Expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1C44 42 B
64 B 175ms
175ms Fetch
image/gif 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu_TwkVUOu9iCbamZxUdIpoE67HeC25_k49-zyatlXzGMsVK-xCcoqojtcGVbRnKrH-jdKLcQfUrzGqhE5uhNJleXBNljt8&sig=Cg0ArKJSzFh0pt43fZdnEAE&id=lidar2&mcvt=1001&p=0,0,90,728&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20221012&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=3047537733&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665681650201&rpt=3861&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame A838
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=duration_media&khaos=L97BUHYP-E-E5FX
https://ads.servenobid.com/sync?pid=323&uid=L97BUHYP-E-E5FX

0
343 B

357ms
357ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=323&uid=L97BUHYP-E-E5FX
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 13 Oct 2022 17:20:56 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ads.servenobid.com/sync?pid=323&uid=L97BUHYP-E-E5FX
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c3b5432477546c086cd062707f625a76
Expires: 0

GET
H3 200 FeVRS0Fbvbc14VxhCLl1.woff2
fonts.gstatic.com/s/judson/v18/ Frame C646 19 KB
19 KB 174ms
174ms Font
font/woff2 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/judson/v18/FeVRS0Fbvbc14VxhCLl1.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Judson:400,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

300e03a1646a93900d6bfb8143d8d6d3d8c436d1d8dd3321f3b89ad6b8fdc41a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 23:10:05 GMT
x-content-type-options: nosniff
age: 583850
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19828
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Oct 2023 23:10:05 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 304ms
303ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=a628b20e-f7ef-ceda-576c-0fced4b83d28&tv=%7Bc:qWFQHb,pingTime:1,time:1790,type:p,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:748%7D,%7Bpiv:0,vs:o,r:l,t:769%7D,%7Bpiv:100,vs:i,r:,t:789%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1002,o:788,n:769,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:747,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~1,0~0%5D,as:%5B38~300.250%5D%7D%7D,%7Bsl:o,t:769,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B20~0%5D,as:%5B20~300.250%5D%7D%7D,%7Bsl:i,t:788,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:294,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C17.10933%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16.bec59399-84d1-ed6a-fb82-930da26a5b4b.21_1193990-66063503%7C16*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:748,sis:971%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 303ms
302ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=a628b20e-f7ef-ceda-576c-0fced4b83d28&tv=%7Bc:qWFQHc,pingTime:1,time:1791,type:c,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:748%7D,%7Bpiv:0,vs:o,r:l,t:769%7D,%7Bpiv:100,vs:i,r:,t:789%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1003,o:788,n:769,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:747,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~1,0~0%5D,as:%5B38~300.250%5D%7D%7D,%7Bsl:o,t:769,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B20~0%5D,as:%5B20~300.250%5D%7D%7D,%7Bsl:i,t:788,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1003~100%5D,as:%5B1003~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:294,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C17.10933%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16.bec59399-84d1-ed6a-fb82-930da26a5b4b.21_1193990-66063503%7C16*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:748,sis:971,metricId:publ1,cmr:t%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 5F45 43 B
215 B 319ms
319ms Image
image/gif 44.194.193.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10933&asId=a628b20e-f7ef-ceda-576c-0fced4b83d28&tv=%7Bc:qWFQHd,pingTime:1,time:1792,type:c,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:748%7D,%7Bpiv:0,vs:o,r:l,t:769%7D,%7Bpiv:100,vs:i,r:,t:789%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1004,o:788,n:769,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:747,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~1,0~0%5D,as:%5B38~300.250%5D%7D%7D,%7Bsl:o,t:769,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B20~0%5D,as:%5B20~300.250%5D%7D%7D,%7Bsl:i,t:788,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1003~100%5D,as:%5B1003~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:jload,dtt:294,fm:tkaisDv+11111%7C112%7C1211%7C122%7C131%7C132%7C141%7C142%7C15%7C16*.10933%7C161%7C162%7C163%7C164%7C165%7C166%7C17.10933%7C171%7C172%7C173%7C174%7C175%7C176%7C177%7C181%7C182%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1c4%7C1c5%7C1c6%7C1d%7C1e%7C1f%7C1g%7C1h1%7C1i1%7C1i2%7C1i3,idMap:16.bec59399-84d1-ed6a-fb82-930da26a5b4b.21_1193990-66063503%7C16*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:748,sis:971,metricId:grpm1,cmr:t%7D&br=c
Requested by: Host: 478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com
URL: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.193.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-193-183.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://478f9d030038ad0f1f5a432c9ddf9d9a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Oct 2022 17:20:55 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 FeVRS0Fbvbc14VxhCLl1.woff2
fonts.gstatic.com/s/judson/v18/ Frame 5116 19 KB
19 KB 173ms
172ms Font
font/woff2 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/judson/v18/FeVRS0Fbvbc14VxhCLl1.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Judson:400,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS