returnsandrefund.com Open in urlscan Pro
35.181.159.169 Public Scan

Software

sffe /

Resource Hash

05fac9131326c8e60070747ff20c51b861a21da401621453a59080c1db855315

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "897 / 854 of 1000 / last-modified: 1623150488"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21288
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:18:14 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 229 KB
67 KB 47ms
47ms Script
application/javascript 2606:4700:3032::ac43:b890
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=medianet,oftmedia,onetag,pulsepoint,rhythmone,spotx,undertone&cb=194-2-22
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:b890 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea20dda1bea1a62c34f9038e3b1bd3bbd8f90a0ff40eed2554302f77135138cf

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 39696
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=sR9H3rW%2FhJaw5qbjrE9ST2nAorPjkEuMExF3Nt9z%2Froi60F1yKa46%2BqaMOOYZ92MrONh3iYnzBqDEQGfMBas8CJwlQ0zhT517K0K2CN31ksQ7J4kuYkSo2UqdrT2m2tooOYtvMUV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 65c41f21bf31325c-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8e71c9150000325cdc96d000000001

GET
H2 200 841ee1dfdec3fbc473772577a8b3240b.css
returnsandrefund.com/wp-content/cache/min/1/ 147 KB
49 KB 68ms
68ms Stylesheet
text/css 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/min/1/841ee1dfdec3fbc473772577a8b3240b.css
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: a965454ed27194420a23bd494e396653825da3850d9d9258d6464dd5e4f26bfc

Request headers

:path: /wp-content/cache/min/1/841ee1dfdec3fbc473772577a8b3240b.css
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=; ezoab_200400=mod1; active_template::200400=pub_site.1623176294; ezopvc_200400=1; ezepvv=0; ezovid_200400=612074826; lp_200400=https://returnsandrefund.com/; ezovuuidtime_200400=1623176294; ezovuuid_200400=0e2456cf-fb7e-4a76-6953-dfc533c7d345; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: br
x-sol: orig
age: 16921
x-ezoic-cdn: Hit ds;mm;889a1bc78332af14281e81a2291c4a35;2-200400-0;6c91b00a-f955-473f-4bb5-5e426a90f8cc
x-cache: HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
display: staticcontent_sol, orig_site_sol
x-cache-hits: 7

GET
H2 200 css
fonts.googleapis.com/ 5 KB
749 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b04c10e9ef56b9200c56cc5141fe6d712ec85a8d90c0fe5b98fbf9ebe2873cc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 18:17:39 GMT
server: ESF
date: Tue, 08 Jun 2021 18:18:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Jun 2021 18:18:14 GMT

GET
H2 200 jquery-1.12.4-wp.js Show response
returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/jquery/ 95 KB
32 KB 423ms
423ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/jquery/jquery-1.12.4-wp.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

:path: /wp-content/cache/busting/1/wp-includes/js/jquery/jquery-1.12.4-wp.js
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=; ezoab_200400=mod1; active_template::200400=pub_site.1623176294; ezopvc_200400=1; ezepvv=0; ezovid_200400=612074826; lp_200400=https://returnsandrefund.com/; ezovuuidtime_200400=1623176294; ezovuuid_200400=0e2456cf-fb7e-4a76-6953-dfc533c7d345; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 11656
x-ezoic-cdn: Bypass
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-cache-hits: 224
x-middleton-response: 200
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
expires: Wed, 08 Jun 2022 15:03:59 GMT

GET
H2 200 responsive-menu-c1e228c238344335eaf7288b4e454a0f.js Show response
returnsandrefund.com/wp-content/cache/min/1/wp-content/themes/eleven40-pro/js/ 765 B
504 B 50ms
50ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/min/1/wp-content/themes/eleven40-pro/js/responsive-menu-c1e228c238344335eaf7288b4e454a0f.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 8e424541604f9439f054eb9e4e78925da8c4d2a77985f642f9f4b5f025424d48

Request headers

:path: /wp-content/cache/min/1/wp-content/themes/eleven40-pro/js/responsive-menu-c1e228c238344335eaf7288b4e454a0f.js
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=; ezoab_200400=mod1; active_template::200400=pub_site.1623176294; ezopvc_200400=1; ezepvv=0; ezovid_200400=612074826; lp_200400=https://returnsandrefund.com/; ezovuuidtime_200400=1623176294; ezovuuid_200400=0e2456cf-fb7e-4a76-6953-dfc533c7d345; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: br
age: 16921
x-ezoic-cdn: Hit ds;mm;c5ae736beb74dda836b2ae3f904f7066;2-200400-0;af0efb0c-369c-4b38-7826-9e69e8fb3c00
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 315
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 6

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 89 KB
35 KB 31ms
30ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-150748452-1

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1c4e1e5d1c59b2fa262abd763610e79aef9bd0292c3f1e6de925af4f70a1fc23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35964
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 08 Jun 2021 18:18:14 GMT

GET
H2 200 cookieconsent.min.js Show response
returnsandrefund.com/ezoic/ 4 KB
2 KB 19ms
19ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/ezoic/cookieconsent.min.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0

Request headers

:path: /ezoic/cookieconsent.min.js
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=; ezoab_200400=mod1; active_template::200400=pub_site.1623176294; ezopvc_200400=1; ezepvv=0; ezovid_200400=612074826; lp_200400=https://returnsandrefund.com/; ezovuuidtime_200400=1623176294; ezovuuid_200400=0e2456cf-fb7e-4a76-6953-dfc533c7d345; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
etag: "11a4-5c3cf8fc12640-gzip"
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1707
expires: Wed, 08 Jun 2022 18:18:14 GMT

GET
H2 200 banger.js Show response
returnsandrefund.com/porpoiseant/ 43 KB
10 KB 21ms
21ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: a7f48a56f55ac16db19f87fcba52d5fad00e19d5b1c9fea867f973649b99a215

Request headers

:path: /porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=; ezoab_200400=mod1; active_template::200400=pub_site.1623176294; ezopvc_200400=1; ezepvv=0; ezovid_200400=612074826; lp_200400=https://returnsandrefund.com/; ezovuuidtime_200400=1623176294; ezovuuid_200400=0e2456cf-fb7e-4a76-6953-dfc533c7d345; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 34ms
7ms Image
image/png 2600:9000:2156:2400:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:2400:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 02:36:22 GMT
via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
x-sol: middleton
age: 229312
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
x-amz-cf-id: 2ZmcROisNqNu9AxR0iKC4JtUR_YO54TemmCxKqUgfk23srTEQ7OasQ==
last-modified: Fri, 28 May 2021 00:46:16 GMT
server: nginx/1.16.0
etag: "49d-5bd497273b080-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
display: staticcontent_sol
expires: Sun, 13 Jun 2021 02:36:22 GMT

GET
H2 200 wp-polyfill.min-7.4.4.js Show response
returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/dist/vendor/ 97 KB
32 KB 430ms
429ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/dist/vendor/wp-polyfill.min-7.4.4.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: d36e5d7328268d21c6941039a7b6a15c7ed7414f60dbee72d2231d11ac9bdaf3

Request headers

:path: /wp-content/cache/busting/1/wp-includes/js/dist/vendor/wp-polyfill.min-7.4.4.js
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=; ezoab_200400=mod1; active_template::200400=pub_site.1623176294; ezopvc_200400=1; ezepvv=0; ezovid_200400=612074826; lp_200400=https://returnsandrefund.com/; ezovuuidtime_200400=1623176294; ezovuuid_200400=0e2456cf-fb7e-4a76-6953-dfc533c7d345; ezCMPCCS=true; ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 11656
x-ezoic-cdn: Bypass
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-cache-hits: 225
x-middleton-response: 200
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
expires: Wed, 08 Jun 2022 15:03:59 GMT

GET
H2 200 index-4e981829b016000918dd61f7ac7dab7e.js Show response
returnsandrefund.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/js/ 13 KB
4 KB 51ms
51ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/js/index-4e981829b016000918dd61f7ac7dab7e.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 457f55ea0c6f05fbf9093f1535e1da2c627530ddbeb46c27a0fb8aef5b7e2805

Request headers

:path: /wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/js/index-4e981829b016000918dd61f7ac7dab7e.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 16921
x-ezoic-cdn: Hit ds;mm;eb5c2d7020fda4533e4f2c14e95b4e90;2-200400-0;3c61f7a5-825a-483f-7158-6e33c94c20ac
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 3778
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 6

GET
H2 200 hoverIntent.min-1.8.1.js Show response
returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/ 1 KB
492 B 350ms
348ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/hoverIntent.min-1.8.1.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 495d2f8c8b7f1bbd664c2c10c086a644e63e4934b9734813b27956a34709eea4

Request headers

:path: /wp-content/cache/busting/1/wp-includes/js/hoverIntent.min-1.8.1.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 11656
x-ezoic-cdn: Bypass
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-cache-hits: 226
x-middleton-response: 200
content-length: 447
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
expires: Wed, 08 Jun 2022 15:03:59 GMT

GET
H2 200 superfish.min-1.7.10.js Show response
returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/ 4 KB
2 KB 48ms
46ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/superfish.min-1.7.10.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: ece565a1f66a32347dfed83562c428ff7736648de72b0027dd8f0e0f27e0c327

Request headers

:path: /wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/superfish.min-1.7.10.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 22582
x-ezoic-cdn: Hit ds;mm;74aa522f6903ecede49f6fe26e67f571;2-200400-0;d8386871-628e-4eb1-660a-a20a665a605b
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 1743
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 6

GET
H2 200 superfish.args.min-3.3.3.js Show response
returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/ 132 B
236 B 34ms
32ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/superfish.args.min-3.3.3.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5

Request headers

:path: /wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/superfish.args.min-3.3.3.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 22582
x-ezoic-cdn: Hit ds;mm;741c3197cbcdb4fa3069ff8bd82b4d2a;2-200400-0;3b188a74-63b7-4305-694a-2554704d9e1a
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 102
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 5

GET
H2 200 skip-links.min-3.3.3.js Show response
returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/ 386 B
295 B 42ms
41ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/skip-links.min-3.3.3.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: ade38136058fcd75880d3673855aff859ee377d5915e59cccf24a973d418bebb

Request headers

:path: /wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/skip-links.min-3.3.3.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 22582
x-ezoic-cdn: Hit ds;mm;9dd6d85aaaabfbd9a62c43b4c9b53dea;2-200400-0;2edb95ca-e80d-4048-5483-1c8b8e225453
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 188
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 6

GET
H2 200 wp-embed.min.js Show response
returnsandrefund.com/wp-includes/js/ 1 KB
704 B 363ms
362ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/wp-includes/js/wp-embed.min.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path: /wp-includes/js/wp-embed.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 11656
x-ezoic-cdn: Bypass
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-cache-hits: 225
x-middleton-response: 200
content-length: 663
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,Origin
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
display: staticcontent_sol, staticcontent_sol
expires: Wed, 08 Jun 2022 15:03:59 GMT

GET
H2 200 ezcl.webp Show response
returnsandrefund.com/utilcave_com/inc/ 1 KB
1012 B 31ms
31ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/utilcave_com/inc/ezcl.webp?cb=4
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319

Request headers

:path: /utilcave_com/inc/ezcl.webp?cb=4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
x-sol: middleton
server: nginx/1.16.0
display: staticcontent_sol
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: max-age=86400
set-cookie: ezoadgid_200400=-1; Path=/; Domain=returnsandrefund.com; Expires=Tue, 08 Jun 2021 18:48:15 UTC ezoref_200400=returnsandrefund.com; Path=/; Domain=returnsandrefund.com; Expires=Tue, 08 Jun 2021 20:18:15 UTC ezoab_200400=mod67; Path=/; Domain=returnsandrefund.com; Expires=Tue, 08 Jun 2021 20:18:15 UTC active_template::200400=pub_site.1623176295; Path=/; Domain=returnsandrefund.com; Expires=Thu, 10 Jun 2021 18:18:15 UTC
content-length: 605

GET
H2 200 pubads_impl_2021060301.js Show response
securepubads.g.doubleclick.net/gpt/ 312 KB
110 KB 16ms
15ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0b3850a417ef733c6acaff02a3311c7ce9a5b7ee55d2cd76d8c7f1f661bcb20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 08:37:25 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112073
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:18:15 GMT

GET
H2 200 nmash.js
returnsandrefund.com/porpoiseant/ 33 KB
9 KB 19ms
19ms Other
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/nmash.js?v=19
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 0b9a8a3f27fa969797b4fbec0716dcacd5aaa38202277691d7baf41a540963fd

Request headers

:path: /porpoiseant/nmash.js?v=19
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=; ezoab_200400=mod1; active_template::200400=pub_site.1623176294; ezopvc_200400=1; ezepvv=0; ezovid_200400=612074826; lp_200400=https://returnsandrefund.com/; ezovuuidtime_200400=1623176294; ezovuuid_200400=0e2456cf-fb7e-4a76-6953-dfc533c7d345; ezCMPCCS=true; ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: same-origin
accept: */*
cache-control: no-cache
sec-fetch-dest: worker
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:14 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
etag: "854d-5c3cf8fc12640;5c3cf8fc12640-gzip"
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex

GET
H2 200 ezosuigeneris.js Show response
g.ezoic.net/ 555 B
566 B 43ms
12ms Script
text/javascript 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigeneris.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: f288d508e65ff7b2cf0643fb41e9f045011553ab93a4e7e1f22a7b3c35ae4361

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
etag: 927d2567405cb05880172ad89add7019
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cache-control: max-age=999999, private
content-length: 279
expires: Mon, 29 Apr 2020 21:44:55 GMT

GET
H2 200 cmb.js Show response
returnsandrefund.com/detroitchicago/ 111 KB
28 KB 29ms
28ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e6512abb12ba7ae739f71e438b4b9a679258477e45d6f7e77dd9f0b5fdc4dc99

Request headers

:path: /detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 return-logo-2.png
returnsandrefund.com/wp-content/uploads/2019/03/ 1 KB
1 KB 27ms
27ms Image
image/png 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://returnsandrefund.com/wp-content/uploads/2019/03/return-logo-2.png
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 31f7540a6075e6f34980199d420271d13d923801da426c060ed01732042a96b8

Request headers

:path: /wp-content/uploads/2019/03/return-logo-2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 303
x-ezoic-cdn: Hit ds;mm;dfcf52210967f019fd4ce3feb2e0509c;2-200400-0;33266581-fa91-49ef-793c-3844c8a8c9c0
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 1075
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: image/png
cache-control: public, max-age=31536000
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 4

GET
H2 200 TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiZQ.woff2
fonts.gstatic.com/s/oswald/v36/ 16 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiZQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

76db825b68979b9ea6cc55fa14373b7bf5e3beb7388cd2efa485938bb2a389fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://returnsandrefund.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:16:43 GMT
x-content-type-options: nosniff
age: 43292
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16016
x-xss-protection: 0
last-modified: Thu, 28 Jan 2021 20:31:14 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:16:43 GMT

GET
H2 200 0QIvMX1D_JOuMwr7Iw.woff2
fonts.gstatic.com/s/lora/v17/ 34 KB
35 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lora/v17/0QIvMX1D_JOuMwr7Iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f762334ff28e79eb7547f6ddb109583d35e0ea3600b71406ca233fb57c12458

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://returnsandrefund.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 02 Jun 2021 01:42:50 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Jan 2021 22:52:25 GMT
server: sffe
age: 578125
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35284
x-xss-protection: 0
expires: Thu, 02 Jun 2022 01:42:50 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-150748452-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 2362
date: Tue, 08 Jun 2021 17:38:53 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Tue, 08 Jun 2021 19:38:53 GMT

GET
H2 200 download-1.png
returnsandrefund.com/wp-content/uploads/2020/02/ 3 KB
3 KB 40ms
39ms Image
image/png 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://returnsandrefund.com/wp-content/uploads/2020/02/download-1.png
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: c63c08ec376a1c99ee774ecbd488d3c33396ea42f8ad0e984179916a2e252849

Request headers

:path: /wp-content/uploads/2020/02/download-1.png
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
age: 44288
x-ezoic-cdn: Hit ds;dm;502accaecac65cd023d490ab18d798a5;2-200400-0;23c875e3-6ea6-4538-72e7-6cdcc06919a0
x-cache: HIT
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 2981
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: image/png
cache-control: public, max-age=31536000
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 1

GET
H2 200 download-4.jpg
returnsandrefund.com/wp-content/uploads/2020/02/ 12 KB
12 KB 52ms
51ms Image
image/jpeg 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://returnsandrefund.com/wp-content/uploads/2020/02/download-4.jpg
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: efca4b1d7c19af67aa04f4a6ef3f9db4c8d3bea417a00240009db7ed26280080

Request headers

:path: /wp-content/uploads/2020/02/download-4.jpg
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
age: 44288
x-ezoic-cdn: Hit ds;dm;42dbe1ec3ee9c20d6caedbd1281216e7;2-200400-0;8da644c1-2e14-4900-5ed7-db6acb4d37ab
x-cache: HIT
content-type: image/jpeg
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 1

GET
H2 200 images-2.jpg
returnsandrefund.com/wp-content/uploads/2020/02/ 9 KB
9 KB 48ms
47ms Image
image/jpeg 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://returnsandrefund.com/wp-content/uploads/2020/02/images-2.jpg
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 8c63493b034323da08e44455885820239e72b10f9fb8b857e8313008f4d6fac5

Request headers

:path: /wp-content/uploads/2020/02/images-2.jpg
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
age: 44287
x-ezoic-cdn: Hit ds;dm;7b4b808955c5813402eef6c10ded310c;2-200400-0;3d5b82d5-a887-4c68-77b8-8dade9baded4
x-cache: HIT
content-type: image/jpeg
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
display: staticcontent_sol, staticcontent_sol
x-cache-hits: 2

GET
H2 200 houston.js Show response
returnsandrefund.com/detroitchicago/ 3 KB
1 KB 18ms
18ms Script
application/javascript 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/detroitchicago/houston.js?gcb=2&cb=36
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 1d6f7818a09adfc9c11ff7110eb866179ef9d36a3625cd1c02e23292d315daaa

Request headers

:path: /detroitchicago/houston.js?gcb=2&cb=36
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex
content-length: 1163

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
16ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
314 B 747ms
742ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=616809956826894&output=ldjh&impl=fifs&eid=31060784%2C21068111&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-box-2%2Creturnsandrefund_com-medrectangle-3%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=300x250%2C580x400%2C300x250&prev_scp=a%3D%257C1%257C%26iid11%3D1085730%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1085730%26eb_br%3Daf063c244089b52ec5a0423a258f1f8e%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D140%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C919%7Ca%3D%257C1%257C%26iid11%3D1084530%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1084530%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D120%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C903%2C919%7Ca%3D%257C3%257C%26iid12%3D1107330%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1107330%26eb_br%3D86802a923a1f32517e4c5d3b6d550271%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D200%26br2%3D300%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C816%2C817%2C899%2C919&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1623157819&dt=1623176295290&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=650%2C345%2C1120&adys=80%2C920%2C471&adks=3330214951%2C3214824028%2C3856334401&ucis=1%7C2%7C3&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x250%7C809x400%7C300x264&msz=300x250%7C580x400%7C300x250&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0%2C0%2C0&ohw=0%2C0%2C0&btvi=0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99c0f1102785320df276e51779237009ffb6c945659f8bd4803fc4832d796efa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 284
x-xss-protection: 0
google-lineitem-id: -2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 77ms
14ms Other
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 cl.gif
returnsandrefund.com/detroitchicago/ 43 B
128 B 19ms
17ms Image
image/gif 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://returnsandrefund.com/detroitchicago/cl.gif?pvID=7b7a23dd-2078-4b45-6a61-653459e684e7&dID=200400
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/cl.gif?pvID=7b7a23dd-2078-4b45-6a61-653459e684e7&dID=200400
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 47

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 28ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=533962932&t=pageview&_s=1&dl=https%3A%2F%2Freturnsandrefund.com%2F&ul=en-us&de=UTF-8&dt=All%20About%20Returns%20%26%20Refunds%20-&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=1563114038&gjid=113682957&cid=1977568968.1623176295&tid=UA-150748452-1&_gid=1395760397.1623176295&_r=1&gtm=2ou621&z=1954395003

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 7ms
7ms Script
application/javascript 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Tue, 15 Jun 2021 18:18:15 GMT

GET
H2 200 imp.gif Show response
returnsandrefund.com/detroitchicago/ 43 B
76 B 25ms
25ms XHR
image/gif 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A1%2C%22ad_load_version%22%3A2%2C%22ad_location_ids%22%3A%2221%2C5%2C1%2C3%2C0%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A5%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A1%2C%22city%22%3A%22Berlin%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A4%2C%22domain_id%22%3A200400%2C%22domain_test_group%22%3A20210304%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A1%2C%22ezcache_skip_code%22%3A7%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A1%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1101%2C1103%2C1108%2C1112%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%227b7a23dd-2078-4b45-6a61-653459e684e7%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%2210178%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A48878%2C%22response_time_orig%22%3A328%2C%22serverid%22%3A%2252.47.209.13%3A20158%22%2C%22state%22%3A%22BE%22%2C%22sub_page_ad_positions%22%3A%221100%2C1101%2C1103%2C1108%2C1112%22%2C%22t_epoch%22%3A1623176294%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Freturnsandrefund.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A2043%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A1%2C%22ad_load_version%22%3A2%2C%22ad_location_ids%22%3A%2221%2C5%2C1%2C3%2C0%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A5%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A1%2C%22city%22%3A%22Berlin%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A4%2C%22domain_id%22%3A200400%2C%22domain_test_group%22%3A20210304%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A1%2C%22ezcache_skip_code%22%3A7%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A1%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1101%2C1103%2C1108%2C1112%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%227b7a23dd-2078-4b45-6a61-653459e684e7%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%2210178%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A48878%2C%22response_time_orig%22%3A328%2C%22serverid%22%3A%2252.47.209.13%3A20158%22%2C%22state%22%3A%22BE%22%2C%22sub_page_ad_positions%22%3A%221100%2C1101%2C1103%2C1108%2C1112%22%2C%22t_epoch%22%3A1623176294%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Freturnsandrefund.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A2043%2C%22worst_bad_word_level%22%3A0%7D
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _ga=GA1.2.1977568968.1623176295; _gid=GA1.2.1395760397.1623176295; _gat_gtag_UA_150748452_1=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 47

GET
H2 200 841ee1dfdec3fbc473772577a8b3240b.css
returnsandrefund.com/wp-content/cache/min/1/ 64 KB
64 KB 41ms
41ms Image
text/css 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://returnsandrefund.com/wp-content/cache/min/1/841ee1dfdec3fbc473772577a8b3240b.css
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/cache/min/1/841ee1dfdec3fbc473772577a8b3240b.css
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _ga=GA1.2.1977568968.1623176295; _gid=GA1.2.1395760397.1623176295; _gat_gtag_UA_150748452_1=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
x-sol: orig
age: 16921
x-ezoic-cdn: Hit ds;mm;889a1bc78332af14281e81a2291c4a35;2-200400-0;6c91b00a-f955-473f-4bb5-5e426a90f8cc
x-cache: HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
display: staticcontent_sol, orig_site_sol
x-cache-hits: 7

GET
H2 200 greenoaks.gif Show response
returnsandrefund.com/detroitchicago/ 0
104 B 18ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDYtMDgifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIyIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6IjkyN2QyNTY3NDA1Y2IwNTg4MDE3MmFkODlhZGQ3MDE5In1dfV0=
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDYtMDgifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIyIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6IjkyN2QyNTY3NDA1Y2IwNTg4MDE3MmFkODlhZGQ3MDE5In1dfV0=
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _ga=GA1.2.1977568968.1623176295; _gid=GA1.2.1395760397.1623176295; _gat_gtag_UA_150748452_1=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:14 UTC

GET
H2 200 ezosuigenerisc.js Show response
g.ezoic.net/ 0
54 B 14ms
14ms Script
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigenerisc.js?nogen=1
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
cache-control: max-age=300, private
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 483 B
291 B 336ms
334ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=1093708718481249&output=ldjh&impl=fifs&eid=31060784%2C21068111&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&prev_scp=a%3D%257C3%257C%26iid12%3D1138530%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1138530%26eb_br%3D5f2b94bb26a5aa9b1a00e66d30cfd5ec%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D500%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1623157819&dt=1623176295338&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1108&adks=3121120320&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7519e2cd48aa9a233306db135127b7c8aeda4a96e5cdce4383bf12868073da0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 261
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
429 B 22ms
22ms Script
application/javascript 2600:9000:218d:5000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218d:5000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 15:10:30 GMT
via: 1.1 c9eda0567a1d169784ebe65d259cdee9.cloudfront.net (CloudFront)
age: 11265
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: CDG50-P2
accept-ranges: bytes
x-amz-cf-id: PfgPu1x8gs8R2U2e7euYyYDQ_6RE4WyGaP7kApJ72JfnPAbZsZUwxQ==

GET
H2 200 pixel;r=251805591;labels=Domain.returnsandrefund_com%2CDomainId.200400;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Freturnsandrefund.com%2F;uht=2;fpan=1;fpa=P0-138635510-1623176295413;pbcn=u;pbc=;ns=0;...
pixel.quantserve.com/ 35 B
371 B 12ms
12ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=251805591;labels=Domain.returnsandrefund_com%2CDomainId.200400;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Freturnsandrefund.com%2F;uht=2;fpan=1;fpa=P0-138635510-1623176295413;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=returnsandrefund.com;je=0;sr=1600x1200x24;dst=1;et=1623176295412;tzo=-120;ogl=

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:15 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 dark-bottom.css
returnsandrefund.com/ezoic/styles/ 3 KB
792 B 19ms
19ms Stylesheet
text/css 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/ezoic/styles/dark-bottom.css
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/ezoic/cookieconsent.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 94edf973e9deb80b5eccf17f8f3108eafe15209fe25fe417e8f8962a4d8f48b3

Request headers

:path: /ezoic/styles/dark-bottom.css
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _ga=GA1.2.1977568968.1623176295; _gid=GA1.2.1395760397.1623176295; _gat_gtag_UA_150748452_1=1; ezosuigeneris=927d2567405cb05880172ad89add7019; __qca=P0-138635510-1623176295413
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
etag: "bd7-5c3cf8fc12640-gzip"
vary: Accept-Encoding Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex
content-length: 725

GET
H2 200 greenoaks.gif Show response
returnsandrefund.com/detroitchicago/ 0
42 B 18ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjU5OSJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiMTIxMCJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiMTEifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiNTUzIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiODUzIn0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6Ijg1NCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9wYWludCIsInZhbCI6IjE3MDUifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjE3MDUifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9lZmZlY3RpdmVfdHlwZSIsInZhbCI6IjRnIn1dfV0=
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjU5OSJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiMTIxMCJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiMTEifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiNTUzIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiODUzIn0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6Ijg1NCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9wYWludCIsInZhbCI6IjE3MDUifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjE3MDUifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9lZmZlY3RpdmVfdHlwZSIsInZhbCI6IjRnIn1dfV0=
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _ga=GA1.2.1977568968.1623176295; _gid=GA1.2.1395760397.1623176295; _gat_gtag_UA_150748452_1=1; ezosuigeneris=927d2567405cb05880172ad89add7019; __qca=P0-138635510-1623176295413; ezux_lpl_200400=1623176295533|7b7a23dd-2078-4b45-6a61-653459e684e7|false; __gads=ID=11f14ef7f15a05bf-226143dc5bc80025:T=1623176295:S=ALNI_ManYAdwpab9mZFnuNiaxUug-Wqz1w
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:16 UTC

GET
H2 200 greenoaks.gif Show response
returnsandrefund.com/detroitchicago/ 0
19 B 18ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjEwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fcnR0IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTAxMCJ9XX1d
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjEwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fcnR0IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTAxMCJ9XX1d
pragma: no-cache
cookie: ezoadgid_200400=-1; ezoref_200400=returnsandrefund.com; ezoab_200400=mod67; active_template::200400=pub_site.1623176295; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _ga=GA1.2.1977568968.1623176295; _gid=GA1.2.1395760397.1623176295; _gat_gtag_UA_150748452_1=1; ezosuigeneris=927d2567405cb05880172ad89add7019; __qca=P0-138635510-1623176295413; ezux_lpl_200400=1623176295533|7b7a23dd-2078-4b45-6a61-653459e684e7|false; __gads=ID=11f14ef7f15a05bf-226143dc5bc80025:T=1623176295:S=ALNI_ManYAdwpab9mZFnuNiaxUug-Wqz1w
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:14 UTC

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 38ms
19ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021060301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de3e10c548733c6786bb6901368253cd3a439af6e9f196a832a421fba7596769

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7903
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:18:15 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 6FD7 12 KB
5 KB 15ms
13ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://returnsandrefund.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://returnsandrefund.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Tue, 08 Jun 2021 18:11:22 GMT
expires: Wed, 08 Jun 2022 18:11:22 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 413
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A00F 783 B
765 B 18ms
17ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

020251783e5f486fc01aed1b09453c21982fc91cf5b4ebc0f9a7b96ca09d127c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-aaR0LfImiXgP9DpXLEyvew' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://returnsandrefund.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://returnsandrefund.com/

Response headers

expires: Tue, 08 Jun 2021 18:18:15 GMT
date: Tue, 08 Jun 2021 18:18:15 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-aaR0LfImiXgP9DpXLEyvew' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js Show response
pagead2.googlesyndication.com/bg/ Frame 6FD7 14 KB
6 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8047292d138b4f46fbe8493b4feed7d0e7777ffb56b3cc7ca0c7131ee9fe21f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 19:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 168473
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5749
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Jun 2022 19:30:22 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021060301&jk=2309956286811287&bg=!KimlKW3NAAY6sG-_OrA7ACkAdvg8WsnpBuVeat5eVuRIBuetAR3I220Mr9uAOU-y-FdCiCNmwBYGvgIAAAB3UgAAAA1oAQcKAN7bksbc25ZOhQIDjGwZh1n-geLl3uIzrN8GeLcLpU71IRYZXYUyqWayCTiQ02_sJcVcETDBidIxajM5FmPCRt_AzkHYEMoNt82Knhtu_cxf_OBwiOJ_eOFCaQUri2uEEG2k9JimKMHrsB2zO5EePNAyooMBBvqhAYDMH1nhetNPzN09z6T91U6kZjnAcdN-p_kymtLrkXu0bl0iVKYntxyF4skks-xAiM5BkdE3YPU5z4Tjn-DoOnww5UQK-FWFqXwmJQmRjDLT1pWhadIE9v0Uh-6gqn6Ymh45EvqHxWWZAnYENdTs8BPx4FXXKfkon5-p8tDncfwKS5gQcEbt3UwHlHt1mxlMg4Xu599ZoVq0PK51HYZH5f_-4UDo7BNDGdOSICrGRi6VgRbp9OZIAAe-tWiTS5SObUGjL4jB366ldhIa2IcwqM_Jg2F8_SwSFcurqD6uV7Ea_W37Rp9bARyO_v13lsYlrFHum1ZOuXCXjv9YZHW2mZ6igdb1waxyVSlYVjOXMXBtmfLBw9MKkRBiNnzLk52X53vpvtptAaLIle460cHTEDnubvrJqhvt3R2ygp36qffPmJUKQO4bShzGfSE5Bz1CvGnXy6pm7pDLo4_z5kbJgj9G-hCz4vDh-qVdgFp48iYcSwQCHH5Uccs-iGYBpayLGAcVt4RzVoZzzf48kIs0VOvQq_U7kYEtD1Jw8aJb1t00gRQNaSXfVByvFs_KJacH8yd-PUAkKlF8_SWPJ-CM8rBXs7pu9CP1Bb-X59KfbAImRRvHm9fQ1JGKRexMX_jd1_TgzL6qjUrFz8p7Ls4E319fw9CO3I5J2NOjpi9Xw5OMB0j8z0D3zzddVwxujJ7fBx9Hc_mwHQXsuLzA6_fZ6wcJyscqIJlFwtT0XRiM3fIGsfDu5t3Mk1eny6j5coatRBKIYY3bJpErQSzC9CfRjttLvlHvxXrvVnRpXLLeQ-Ox2tGPrIVsbVe-o22AWRAY8OgD0viGKt_dUdaOmxFpffOqpE91pozW1Qso6_AY7KbcWJhrnGf7rlKeC9ZL7oOmraDaTaJG71zyZYPsGZco4FqUel0Zf2DGCVVTQSOKVEGfD-ZXpxP2-CuRpCtShmkzjSnnqgSKYGuHoJL7YA6NlXg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 31ms
15ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 28ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 458 B
265 B 460ms
459ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=2865213141012341&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=a%3D%257C3%257C%26iid12%3D1107330%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1107330%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D100%26br2%3D300%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C816%2C817%2C899%2C919%2C17%2C20%26lb%3D200%26reqt%3D1623176298422&eri=1&cookie=ID%3Daa9aabb52316cf4d-22a7f0d35bc8004c%3AT%3D1623176295%3AS%3DALNI_MYcZh-qt8aqmr02fAwtFltoV2zPvQ&bc=31&abxe=1&lmt=1623157819&dt=1623176298432&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=1120&adys=471&adks=3856334401&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x264&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

931531e9120d758ce2a5eb522c8cde8fa237fa58ced9e9861a75b26fc39b5396

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 467 B
278 B 346ms
346ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=1881933024699667&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&ris=3&rcs=1&prev_scp=a%3D%257C1%257C%26iid11%3D1084530%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1084530%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D60%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C903%2C919%2C17%2C19%2C20%26lb%3D120%26reqt%3D1623176298425&eri=1&cookie=ID%3Daa9aabb52316cf4d-22a7f0d35bc8004c%3AT%3D1623176295%3AS%3DALNI_MYcZh-qt8aqmr02fAwtFltoV2zPvQ&bc=31&abxe=1&lmt=1623157819&dt=1623176298434&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=345&adys=920&adks=3214824028&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x400&msz=580x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e1aa4a19cc7741668e390ae25d229e8cc5d8919241d181f94604ba858734645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 451 B
261 B 630ms
628ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=140112118369053&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=a%3D%257C1%257C%26iid11%3D1085730%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1085730%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D70%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C919%2C17%2C19%2C20%26lb%3D140%26reqt%3D1623176298426&eri=1&cookie=ID%3Daa9aabb52316cf4d-22a7f0d35bc8004c%3AT%3D1623176295%3AS%3DALNI_MYcZh-qt8aqmr02fAwtFltoV2zPvQ&bc=31&abxe=1&lmt=1623157819&dt=1623176298437&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=80&adks=3330214951&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x250&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f58f8f40b53bc1c55ff96ed26e9b8dbe6ad524476c03ad351464e285a404aecd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:19 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 230
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 73 KB
14 KB 662ms
661ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=1927852810176708&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=3&rcs=1&prev_scp=a%3D%257C3%257C%26iid12%3D1138530%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1138530%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D260%26br2%3D240%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C20%26lb%3D500%26reqt%3D1623176298428&eri=1&cookie=ID%3Daa9aabb52316cf4d-22a7f0d35bc8004c%3AT%3D1623176295%3AS%3DALNI_MYcZh-qt8aqmr02fAwtFltoV2zPvQ&bc=31&abxe=1&lmt=1623157819&dt=1623176298441&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1108&adks=3121120320&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5deef6a4e6ab98486cde5ca56bbbd19bc22921e002053a56f8dfbae7392ff907

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13866
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012105242203000/ Frame 9EA5 191 KB
54 KB 41ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b90f60459b17f2ddf447768e249c21c662e70bde6148deff13643982f93f9a6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 387131
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55246
x-xss-protection: 0
server: sffe
date: Fri, 04 Jun 2021 06:46:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e9907e100ee706e0"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Jun 2022 06:46:08 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame 9EA5 12 KB
5 KB 29ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8de063d7075aa9a9a68120f3eb37178e85777138d4154903a2d4b187b4a893d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 17994
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4568
x-xss-protection: 0
server: sffe
date: Tue, 08 Jun 2021 13:18:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b435c2fa80137a0e"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 13:18:25 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame 9EA5 87 KB
27 KB 37ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12993a139a46e15abb56308ef8656d80812fb748dfa88116ee6e20ad3494ae98

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 43305
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27371
x-xss-protection: 0
server: sffe
date: Tue, 08 Jun 2021 06:16:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6687a81702b10306"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:16:34 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame 9EA5 70 KB
16 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c5563da3d1d8ffdd50815ecffd1c8549c4c8828429322f53effb7fe69814a0d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 3953
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16346
x-xss-protection: 0
server: sffe
date: Tue, 08 Jun 2021 17:12:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "60764f3de0d417cf"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 17:12:26 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame 9EA5 4 KB
2 KB 34ms
12ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de4196056e2ffb92e9e6eb78502d3ed77f71a1e8045434a907251ff0b998357

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 17994
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1521
x-xss-protection: 0
server: sffe
date: Tue, 08 Jun 2021 13:18:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5a9e085610d63d0a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 13:18:25 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame 9EA5 41 KB
13 KB 34ms
12ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e53b8865f7f1e34e44d14f6ff8789dd7f421e7d3c69e48dab33188ff4d99f4e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 387133
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13132
x-xss-protection: 0
server: sffe
date: Fri, 04 Jun 2021 06:46:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1bd5431ac5ac76b7"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Jun 2022 06:46:06 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9EA5 4 KB
741 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:600,regular

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

58071d60d23e669438756d9c508bf141d8df6a1343734a4daa9c6f060720e811

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 16:46:26 GMT
server: ESF
date: Tue, 08 Jun 2021 18:18:19 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Jun 2021 18:18:19 GMT

GET
DATA 200
OK truncated
/ Frame 9EA5 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fbc0d2d74d9aeaec09e3369a91b9c2ea9bbee7434abbba77e4e605b77ca80831

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9EA5 2 KB
3 KB 6ms
5ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 13:34:38 GMT
x-content-type-options: nosniff
server: cafe
age: 17021
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 09 Jun 2021 13:34:38 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9EA5 295 B
399 B 7ms
6ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 20:37:24 GMT
x-content-type-options: nosniff
server: cafe
age: 78055
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 08 Jun 2021 20:37:24 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 9EA5 0
0 14ms
13ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTyXwl9-R7ItDV56YBwa2Bk4MoP8ZcgVqcmhtAQjfdAho7XlCnY6eoQdTG5kt1Kla26Po_H3QGBsJ82NovLjFiZR5aNXA
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9EA5 0
0 43ms
42ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=ClH-XarS_YNSBHpKQ4gG2jLjIDsfej6Niif2KtrMN9q395I4OEAEg9PnGJWCV-vCBjAegAeiv88UDyAEJqQLhSqvxym20PuACAKgDAcgDCKoE3wFP0CWtjyB3Vh6qZTsHmNbN_J8ZcnU6lxdiNMMoNmd2PQDbPSclJTfi7XL4CJL23k3Wv3fJZv8j-MTh2xeEhfNZAs3p24nyR-djJ-rjsZd2hKouRGCxPdHob_Rc9KSsnraUIyl5oWuixKCzHEO5X7lwmG-SsEvZe7C4cRRy2X7YRdUot5xGHOVUX8EZv-2PoKE6mLC99fjSm8gux928OH3FM1ee9-0kLyCgcZt7exEqKV85t3Ry2XpoJKvMegCFSTqJ4xYMM9s6GisPHHIl5EzoB8FyQvAnacyJ6u4QEW1owATs0uCAxQPgBAGSBQQIBBgBkgUECAUYBKAGLoAHgNCMOqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBRCn4J4B0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi01ODkzMjk0NDYyMDYxMTQwgAoDyAsB2BMN0BUBgBcBshcaChgIABIUcHViLTYzOTY4NDQ3NDI0OTcyMDg&sigh=KJjzfbwVXIY&template_id=419
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 970x90px.png
tpc.googlesyndication.com/sadbundle/15439105080065294801/ Frame 9EA5 3 KB
3 KB 7ms
6ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15439105080065294801/970x90px.png

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2c92a041ef848dc25007e91b00554ef7333a39089fd7d77f35e4a187bf1aba9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 05:05:05 GMT
x-content-type-options: nosniff
age: 479594
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2861
x-xss-protection: 0
last-modified: Sat, 24 Apr 2021 14:44:46 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Jun 2022 05:05:05 GMT

GET
H2 200 greenoaks.gif Show response
returnsandrefund.com/detroitchicago/ 0
65 B 17ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjQ0NzYifV19XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjQ0NzYifV19XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:19 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
42 B 17ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMzg1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjU3OTE0YzM3MTYzMTJjYjdlOTU0MDkwZjA3MTdlYTI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTM4NTMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTM4NTMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzU1MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMzg1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjU3OTE0YzM3MTYzMTJjYjdlOTU0MDkwZjA3MTdlYTI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTM4NTMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTM4NTMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzU1MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:19 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:17 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
93 B 32ms
9ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 08 Jun 2021 18:18:19 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 18ms
18ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:19 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 18ms
18ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2Mjk5LCJhZF9wb3NpdGlvbiI6MTEwMCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjo1MDAsImJpZF9mbG9vcl9wcmV2Ijo1MDAsImJpZF9mbG9vcl9maWxsZWQiOjI2MCwiYXVjdGlvbl9jb3VudCI6MiwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6Njg2LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2Mjk5LCJhZF9wb3NpdGlvbiI6MTEwMCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjo1MDAsImJpZF9mbG9vcl9wcmV2Ijo1MDAsImJpZF9mbG9vcl9maWxsZWQiOjI2MCwiYXVjdGlvbl9jb3VudCI6MiwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6Njg2LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:19 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ Frame 9EA5 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:600,regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://returnsandrefund.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 12:56:46 GMT
x-content-type-options: nosniff
last-modified: Tue, 18 May 2021 21:21:26 GMT
server: sffe
age: 19293
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14956
x-xss-protection: 0
expires: Wed, 08 Jun 2022 12:56:46 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9EA5 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012105242203000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 13:34:38 GMT
x-content-type-options: nosniff
server: cafe
age: 17021
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 09 Jun 2021 13:34:38 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9EA5 295 B
319 B 7ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012105242203000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 20:37:24 GMT
x-content-type-options: nosniff
server: cafe
age: 78055
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 08 Jun 2021 20:37:24 GMT

GET
H3-29 200 970x90px.png
tpc.googlesyndication.com/sadbundle/15439105080065294801/ Frame 9EA5 3 KB
3 KB 7ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15439105080065294801/970x90px.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012105242203000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2c92a041ef848dc25007e91b00554ef7333a39089fd7d77f35e4a187bf1aba9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 05:05:05 GMT
x-content-type-options: nosniff
age: 479594
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2861
x-xss-protection: 0
last-modified: Sat, 24 Apr 2021 14:44:46 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Jun 2022 05:05:05 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
56 B 39ms
38ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=2309956286811287&vrg=2021060301&nw_id=1254144&nslots=4&eid=31060784%2C21068111%2C676982961&pub_url=https%3A%2F%2Freturnsandrefund.com%2F&qid=CNTet_XSiPECFRKIOAodNgYO6Q&iu=%2F1254144%2Freturnsandrefund_com-medrectangle-2&e=0&ret=970x90&req=970x90&bm=0&efh=1&stk=1&ifi=8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 342 B
172 B 429ms
429ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=2805601595953047&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=a%3D%257C3%257C%26iid12%3D1107330%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1107330%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D70%26br2%3D300%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C816%2C817%2C899%2C919%2C17%2C20%2C17%2C19%2C20%26lb%3D100%26reqt%3D1623176298946&eri=1&cookie=ID%3Daa9aabb52316cf4d%3AT%3D1623176295%3AS%3DALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g&bc=31&abxe=1&lmt=1623157819&dt=1623176299958&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=1120&adys=471&adks=3856334401&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x264&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19071465d033c5648364497a161dd7a9f1d6b3f224945801d8e2679b13106693

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 351 B
183 B 286ms
286ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=1962558701093453&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&ris=2&rcs=2&prev_scp=a%3D%257C1%257C%26iid11%3D1084530%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1084530%26eb_br%3D1e913e99b80640fd5b86a539e5b97c94%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D22%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C903%2C919%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26lb%3D60%26reqt%3D1623176298946&eri=1&cookie=ID%3Daa9aabb52316cf4d%3AT%3D1623176295%3AS%3DALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g&bc=31&abxe=1&lmt=1623157819&dt=1623176299961&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=345&adys=920&adks=3214824028&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x400&msz=580x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fbf26920de690bfbd33ffcc57bf48a4420d3a5b4d2a9785b7fdd0b0802dae12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 154
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 14ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 392ms
391ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=3090037866035014&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=a%3D%257C1%257C%26iid11%3D1085730%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1085730%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D36%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C919%2C17%2C19%2C20%2C17%2C19%2C20%26lb%3D70%26reqt%3D1623176299077&eri=1&cookie=ID%3Daa9aabb52316cf4d%3AT%3D1623176295%3AS%3DALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g&bc=31&abxe=1&lmt=1623157819&dt=1623176300090&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=80&adks=3330214951&ucis=b&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x250&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe5f68f5ba4ede77f652ff7d4164f235ba73950c06f27784aacc3a7ac94793dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8851
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnsandrefund.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 266ms
265ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=2502219436279890&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=3&prev_scp=a%3D%257C3%257C%26iid12%3D1107330%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1107330%26eb_br%3D947f1d5169cc7d0f997560e34838fb04%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D42%26br2%3D300%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C816%2C817%2C899%2C919%2C17%2C20%2C17%2C19%2C20%2C17%2C19%2C20%26lb%3D70%26reqt%3D1623176300472&eri=1&cookie=ID%3Daa9aabb52316cf4d%3AT%3D1623176295%3AS%3DALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g&bc=31&abxe=1&lmt=1623157819&dt=1623176300477&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=1120&adys=471&adks=3856334401&ucis=c&ifi=12&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x264&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38a1560f433b836e30debe31fb6906b91160d0b794ea3cbe44ec2b64821ed332

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8632
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 45 KB
11 KB 241ms
241ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2309956286811287&correlator=997645549774276&output=ldjh&impl=fifs&eid=31060784%2C21068111%2C676982961&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&ris=1&rcs=3&prev_scp=a%3D%257C1%257C%26iid11%3D1084530%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1084530%26eb_br%3Db6c98a8bb15764f1c4ee331dcb724178%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D2%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C903%2C919%2C17%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26lb%3D22%26reqt%3D1623176300475&eri=1&cookie=ID%3Daa9aabb52316cf4d%3AT%3D1623176295%3AS%3DALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g&bc=31&abxe=1&lmt=1623157819&dt=1623176300479&dlt=1623176294669&idt=568&frm=20&biw=1600&bih=1200&oid=3&adxs=345&adys=920&adks=3214824028&ucis=d&ifi=13&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x400&msz=580x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1977568968.1623176295&ga_sid=1623176295&ga_hid=533962932&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

ca8dd3290f64b35783efd085c87f56d56c4173ee67587a6a13289b7d483971c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11014
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnsandrefund.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8977 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://returnsandrefund.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://returnsandrefund.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 08 Jun 2021 18:18:15 GMT
expires: Wed, 08 Jun 2022 18:18:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 42ms
21ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d8c7ce12428be733a9213b2fecae66db6950a933c276d68bf7c8271829a627d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066164336645"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28149
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:18:20 GMT

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 19ms
18ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODU3MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjhjNWZmZWZiMTIyZjU5YTY2YThiNzY3MmQ0NDUyYWYyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMDg1NzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDM2LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMzYsImJpZF9mbG9vcl9wcmV2IjowLjAwMDcsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMDg1NzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDUxNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODU3MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjhjNWZmZWZiMTIyZjU5YTY2YThiNzY3MmQ0NDUyYWYyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMDg1NzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDM2LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMzYsImJpZF9mbG9vcl9wcmV2IjowLjAwMDcsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMDg1NzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDUxNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=296; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
40 B 10ms
9ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
65 B 17ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=296; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 17ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2MzAwLCJhZF9wb3NpdGlvbiI6MTExMiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjoxNDAsImJpZF9mbG9vcl9wcmV2Ijo3MCwiYmlkX2Zsb29yX2ZpbGxlZCI6MzYsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjQwNSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2MzAwLCJhZF9wb3NpdGlvbiI6MTExMiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjoxNDAsImJpZF9mbG9vcl9wcmV2Ijo3MCwiYmlkX2Zsb29yX2ZpbGxlZCI6MzYsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjQwNSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=296; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 77C3 624 B
350 B 15ms
15ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVBtgGbwtuIbA_asvv8aT0nDupvSLGsQFxb_tZ-Tz5f05OI6NPPFhFAEYN0ELz5p-tcv9p-xu0nPjUHgxzns7h8P20qY8KZx4iw6bDhVvXa63iyKAk5N-hA0_WN28u83hV3YX4WVb5wa_WLXkpuW2gyZNh7ThKeSxlsOsUanwdHu1292F0xCTsPhUa_5ajhpMZtBE4w9B0cAQ1XcVCAHDIBaJ1HWw

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVBtgGbwtuIbA_asvv8aT0nDupvSLGsQFxb_tZ-Tz5f05OI6NPPFhFAEYN0ELz5p-tcv9p-xu0nPjUHgxzns7h8P20qY8KZx4iw6bDhVvXa63iyKAk5N-hA0_WN28u83hV3YX4WVb5wa_WLXkpuW2gyZNh7ThKeSxlsOsUanwdHu1292F0xCTsPhUa_5ajhpMZtBE4w9B0cAQ1XcVCAHDIBaJ1HWw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUk94-lYJfG3RnEvO9Oj8CRHXbXFyGRAkedExTPrFFh60i-T_UFOm3xx9r8jPlg
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 08 Jun 2021 18:18:20 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8977 43 KB
21 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsVYRNL_O8I9jvY7WwSxX74_BckGJg98paBNawbKLDMhAjI-oKmHQjfQ08XTmjOxEG4pFC_mnvcdSNfWIm1IW0vIz5_7pl5J1YpkgXoCI_wZ-z-d1ya_iVPhuExTpfkbmGAUE-rKT4lCyGl29qOGNwQgpUAQ&dbm_d=AKAmf-DesMvyEYax3C58sgYOCy0kkkbYSZNDoURgJ5PpKuqPXz-XA1GV5M5DxVm1acFEHzI2Fqgo3m6w5RDKBfMDcUmg2-GBEPtwgu3OJNpSmUfGzgKXQ5p9BUKmTg_hKCgHytzjr-QHYxfX1ZukFp095tAqLDCwxiBQ-a8WvjZi6m0v4RNCv6WdvsRN_QcGbyyW7PcN2nFLDQzVCQvJMWY-TDG-1grMFRw0ik5godI8IPaJ-5OVuCP_L7GJHXFEW3vXkmihMxykrMo6i9QLKCvVItQiQhras00w03Mnu4lTYBo0M5XpGyFkhLFnRIoPEvkcrsMtl8jooMdquRjC20JtjR1OliD0GhRRjDJlmughsL706sUj11R6gyY21pA_eBWMiOT4_VNsFhodKVfvLWJ8NrYCypzAFDUqBnMgt7yz5dzST0drUN8RKYDlBJRirDa2LcPTLk0v--VwyvWaWVedvW0AzQNUOMZRKjnweBZTmbvEoJqMhFKlNKLGMQxmmspBWjGe7ds4clYWxOw2_qpYtg6-s_QKe33hhUmtbAWJkEX-mlNXQLaCIWmTM1nZv8QvFJznna_QwIlEfq5VVJYFNmT6O6IyqSYIBeSl88xloCwHNwtWoF039gxcMX7_dvudOkd7UwxCig1U98zY-gTZ8a17A4_AbfAGvgKX3KYme1oWHqCHIh94peDIepobGKZyWfi6NsHM_89jXe3MpUvCzbZ3LFhN_e5ytMpp60r2rz0PT1lXcjI77Fd0aHvNR-87XJxPUY32pV4gA7m4pKzFfdNVTXcNdOipODSIJql-9sTvRMDXRbPb8Rka7PrOlB-ZSU1hFtkQ4Bmw8BcyQHyx61cUEFgX05rLBMTx2y3DRESxNoo0Y7ZreuQkGKuMTLfzjiOwlDOSZMX-7tCfUzLP1dRcX3xPFVl3hICnliWv2jq3fnEl2Pmm65duKtIDtTbc4RGT_9LSTobzx6ckjDj7CAeKL5eoRW3c6bRnEAyhEbcflNTJJuAAHPW5ICFxS7Hf1P3bBBl7TR_qixv7dDTXwbQqKQgJm2ZcpHjzt2o3XcKmYt5OXleezYtrUA7OBOBfhVf8cqKyPYIWxDKuqWwdxPl9sBdMucJsXBHeoYBhXl104hFusd4-eLKNTsQonXx869yTapaIKlJmR1iU0NLNX6nF-0Duev6hGKETIAPiVCZ5RauN9EFIxLI_OudPLfweYkEmuDvqlfc6dds9Nnh2aWF7DOAchueE8rhDqbhgRmNrP5hTMv7ZKKdUtPm7Cij1BYYiYFh2oykJQsfpQ4rXs-DshYuMETsP86hHjX34CoXAhfnpVFby3rfTi3CmdEWFBby9xzL2D0PamomMmCkWEH9L0ZpWfI6CoXsDrz59LfMs13fHiQrdxLlvuGKdCYKvscdgO3cWBLNqta_EtUVuHWOwPXUb6IgIsoPMeimXnz2lvMMznxHxD7i9o1282oo2Ao3NAGQEXo8tQTke71ttk512pcTFhL5CYMiBqnKvdgW5cqYKX24YdQMUvmMGJHChfRCvRSC2mWo8tbfKlIPBGQ_oSNvJXYlgyikCn1Z6HHiEiaQNuG3Ya3UeAynR008oOMOwy0eA6eJIOXGfPX6lxz8eFmWdI221YIZnxua1N-GThy93m2P__mVQf0sStwZdAEdtGsEzZsbquNg0Yp40vmRTQdbL7vU1fykKIxCW2uX1VzZoxPR8ELgsZlxxkmguTx4YzlkeGpzPb9N6nmpmRD7EX5Gc9hIgmrgIIlSdK1NWJML-YccHf0QwtUo1GFcnbo58VrknOyYAUpgVvrHWxEhcObb-RkC-njGyGMY2JlS6AXyZqBS1xdmK7veK3AglGxHoWwcIOhJLs81JSdSCceCedsx2veRENIlYkUFt2UonFph3bq06102WXGUoYr0Swz40LaqeWa8Si9iJvUuhbg0DbRGuhYnZnhWWpCqVeOfvT7-WyLSDuunusrhxhacbme_s7jqvsOr_G21Q3K-wbjGowtSiCZiA-jn-3YzMHVpw8Vd70LMcjxrlF-oSQM5L_rXZIVsDnpXrBlh4RCamW9pXYYQEQWfByRjurmuKoQCVrX6yfY7zXwsofVSjfyP-7a3A2iYLxt8ZNNozBOz7UHDOrEbcmhZZZVQs8R4P8rlAlgPlM1SJPQZtjmnX1kw1iytlQeZDn55dp-IDrdeHcqiKrV038WgfQBsaO7TSbe8ShdUd5AjvTUm3XBCTASOtkli9Smn99rLNHNtYtkGoCDDbeUXvTfWt3T_uBTk0cS6wTeup0YVA-5SowmUP5zgrvUIXgZetzJJuFtpjnAL_sAfU6G9HsGubXF-pbmm2Xj4K02sDEBz3fvEIaYYNCTsB1zUcmBAS9bZBMvUFi4MnQSeWsX9qDqPa9JedeXnsfykXcn_I2z-xArFP4c8yIwAHhHP_qZYYWiCKyy6FQkuFUcVmW1YY22CxXwzvj3Jpr_KCU3opsRjL5zmN_lXia3Kr4s_T9sUvUFPrOeWP2ttYdM4A-320NIGJAmFNPdUBnZx5bJdBSZrwRkUMaFBb4M4LjtPNjesMQ3kAFiL2t08pbnMS2PTbs22REgdNduDTCcjTW71yhu-6TBgIh5CdY1AW8IhKRaBOLndLTKHfYL8LnTE2Y4eVr5qzhGs2_DuSlBNSACNYFaViWSnp6a6HJ7oGeQ_JE4EoXyvsb4yWcEdX6DERJJ7q6fK-kwvCcmH059CFej7TelGqXLxcHvOHlQydBaw6pbTIUZc-00OaSe-dLHoZDeIIMg94xtjf1C30jyGHODCfgt4owoD5wdMnTmLrXOZ48_orWxXyhCA9xN_4gqGRUAwnCQUn83g5cJ32LiuQlEi69zCGTYvHtPQwGeFnSR3HtOnsQKNgYariGoHdxs5rbvqyXB--KnxnMM04LJMDi0wIXsrtzCjbw7_auYJ1xOrNMh_Uu_syQUfEo_n47vfmPvasJvFZ2vTQYJU0-VTH6R_MpgA&cid=CAASEuRoHbXW2gWBLcz1Q9amZ3Fbgg&rfl=1%2Chttps%253A%252F%252Freturnsandrefund.com%252F%240

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b9d707d95b22c4fb4909fcd044867ca4ee6f8f8229f413011563064cf21c845

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21377
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8977 42 B
63 B 39ms
38ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A1voSbSGuih02JjPvbztlHhcM7ROTvgE3lhaKra8ccBWlI7zf55nVxXuIRUpfltRvAjDNqYSfWjNJR6TNhKPiMwry7RBpj9gIAFU6NDQaL6N0IuLk

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame 8977 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:18:04 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8977 122 KB
38 KB 18ms
13ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:18:20 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame 8977 13 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:16:39 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 77C3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1

43 B
1014 B

31ms
17ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVBtgGbwtuIbA_asvv8aT0nDupvSLGsQFxb_tZ-Tz5f05OI6NPPFhFAEYN0ELz5p-tcv9p-xu0nPjUHgxzns7h8P20qY8KZx4iw6bDhVvXa63iyKAk5N-hA0_WN28u83hV3YX4WVb5wa_WLXkpuW2gyZNh7ThKeSxlsOsUanwdHu1292F0xCTsPhUa_5ajhpMZtBE4w9B0cAQ1XcVCAHDIBaJ1HWw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 18:18:20 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 77C3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL.0bFUHSMQtr4tx7xfgIwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1&google_hm=2

43 B
894 B

15ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVBtgGbwtuIbA_asvv8aT0nDupvSLGsQFxb_tZ-Tz5f05OI6NPPFhFAEYN0ELz5p-tcv9p-xu0nPjUHgxzns7h8P20qY8KZx4iw6bDhVvXa63iyKAk5N-hA0_WN28u83hV3YX4WVb5wa_WLXkpuW2gyZNh7ThKeSxlsOsUanwdHu1292F0xCTsPhUa_5ajhpMZtBE4w9B0cAQ1XcVCAHDIBaJ1HWw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 18:18:20 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 77C3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHxuweNVr6SmEbAEbEPnDp0&google_cver=1

43 B
1 KB

24ms
14ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHxuweNVr6SmEbAEbEPnDp0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVBtgGbwtuIbA_asvv8aT0nDupvSLGsQFxb_tZ-Tz5f05OI6NPPFhFAEYN0ELz5p-tcv9p-xu0nPjUHgxzns7h8P20qY8KZx4iw6bDhVvXa63iyKAk5N-hA0_WN28u83hV3YX4WVb5wa_WLXkpuW2gyZNh7ThKeSxlsOsUanwdHu1292F0xCTsPhUa_5ajhpMZtBE4w9B0cAQ1XcVCAHDIBaJ1HWw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:20 GMT
X-Proxy-Origin: 152.89.163.156; 152.89.163.156; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.239:80
AN-X-Request-Uuid: ff97d137-eb1f-46ac-9b97-7a221a6eb3c1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHxuweNVr6SmEbAEbEPnDp0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 77C3
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwNTI2MzE4MzQ3OTIwMDgxOQ%3D%3D

170 B
188 B

24ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwNTI2MzE4MzQ3OTIwMDgxOQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:20 GMT
X-Proxy-Origin: 152.89.163.156; 152.89.163.156; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.47:80
AN-X-Request-Uuid: 489fb29a-553e-43a3-8043-b1051030bc69
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwNTI2MzE4MzQ3OTIwMDgxOQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 18ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODQ1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI1MiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMzkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMzg1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI3NiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODQ1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI1MiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMzkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMzg1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI3NiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=296; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 18ms
18ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI2NTAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjgwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzNDUifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjkyMCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMDczMzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMTEyMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNDcxIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMTAwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NTczMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI2NTAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjgwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzNDUifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjkyMCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMDczMzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMTEyMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNDcxIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMTAwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=296; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/ Frame 8977 22 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsVYRNL_O8I9jvY7WwSxX74_BckGJg98paBNawbKLDMhAjI-oKmHQjfQ08XTmjOxEG4pFC_mnvcdSNfWIm1IW0vIz5_7pl5J1YpkgXoCI_wZ-z-d1ya_iVPhuExTpfkbmGAUE-rKT4lCyGl29qOGNwQgpUAQ&dbm_d=AKAmf-DesMvyEYax3C58sgYOCy0kkkbYSZNDoURgJ5PpKuqPXz-XA1GV5M5DxVm1acFEHzI2Fqgo3m6w5RDKBfMDcUmg2-GBEPtwgu3OJNpSmUfGzgKXQ5p9BUKmTg_hKCgHytzjr-QHYxfX1ZukFp095tAqLDCwxiBQ-a8WvjZi6m0v4RNCv6WdvsRN_QcGbyyW7PcN2nFLDQzVCQvJMWY-TDG-1grMFRw0ik5godI8IPaJ-5OVuCP_L7GJHXFEW3vXkmihMxykrMo6i9QLKCvVItQiQhras00w03Mnu4lTYBo0M5XpGyFkhLFnRIoPEvkcrsMtl8jooMdquRjC20JtjR1OliD0GhRRjDJlmughsL706sUj11R6gyY21pA_eBWMiOT4_VNsFhodKVfvLWJ8NrYCypzAFDUqBnMgt7yz5dzST0drUN8RKYDlBJRirDa2LcPTLk0v--VwyvWaWVedvW0AzQNUOMZRKjnweBZTmbvEoJqMhFKlNKLGMQxmmspBWjGe7ds4clYWxOw2_qpYtg6-s_QKe33hhUmtbAWJkEX-mlNXQLaCIWmTM1nZv8QvFJznna_QwIlEfq5VVJYFNmT6O6IyqSYIBeSl88xloCwHNwtWoF039gxcMX7_dvudOkd7UwxCig1U98zY-gTZ8a17A4_AbfAGvgKX3KYme1oWHqCHIh94peDIepobGKZyWfi6NsHM_89jXe3MpUvCzbZ3LFhN_e5ytMpp60r2rz0PT1lXcjI77Fd0aHvNR-87XJxPUY32pV4gA7m4pKzFfdNVTXcNdOipODSIJql-9sTvRMDXRbPb8Rka7PrOlB-ZSU1hFtkQ4Bmw8BcyQHyx61cUEFgX05rLBMTx2y3DRESxNoo0Y7ZreuQkGKuMTLfzjiOwlDOSZMX-7tCfUzLP1dRcX3xPFVl3hICnliWv2jq3fnEl2Pmm65duKtIDtTbc4RGT_9LSTobzx6ckjDj7CAeKL5eoRW3c6bRnEAyhEbcflNTJJuAAHPW5ICFxS7Hf1P3bBBl7TR_qixv7dDTXwbQqKQgJm2ZcpHjzt2o3XcKmYt5OXleezYtrUA7OBOBfhVf8cqKyPYIWxDKuqWwdxPl9sBdMucJsXBHeoYBhXl104hFusd4-eLKNTsQonXx869yTapaIKlJmR1iU0NLNX6nF-0Duev6hGKETIAPiVCZ5RauN9EFIxLI_OudPLfweYkEmuDvqlfc6dds9Nnh2aWF7DOAchueE8rhDqbhgRmNrP5hTMv7ZKKdUtPm7Cij1BYYiYFh2oykJQsfpQ4rXs-DshYuMETsP86hHjX34CoXAhfnpVFby3rfTi3CmdEWFBby9xzL2D0PamomMmCkWEH9L0ZpWfI6CoXsDrz59LfMs13fHiQrdxLlvuGKdCYKvscdgO3cWBLNqta_EtUVuHWOwPXUb6IgIsoPMeimXnz2lvMMznxHxD7i9o1282oo2Ao3NAGQEXo8tQTke71ttk512pcTFhL5CYMiBqnKvdgW5cqYKX24YdQMUvmMGJHChfRCvRSC2mWo8tbfKlIPBGQ_oSNvJXYlgyikCn1Z6HHiEiaQNuG3Ya3UeAynR008oOMOwy0eA6eJIOXGfPX6lxz8eFmWdI221YIZnxua1N-GThy93m2P__mVQf0sStwZdAEdtGsEzZsbquNg0Yp40vmRTQdbL7vU1fykKIxCW2uX1VzZoxPR8ELgsZlxxkmguTx4YzlkeGpzPb9N6nmpmRD7EX5Gc9hIgmrgIIlSdK1NWJML-YccHf0QwtUo1GFcnbo58VrknOyYAUpgVvrHWxEhcObb-RkC-njGyGMY2JlS6AXyZqBS1xdmK7veK3AglGxHoWwcIOhJLs81JSdSCceCedsx2veRENIlYkUFt2UonFph3bq06102WXGUoYr0Swz40LaqeWa8Si9iJvUuhbg0DbRGuhYnZnhWWpCqVeOfvT7-WyLSDuunusrhxhacbme_s7jqvsOr_G21Q3K-wbjGowtSiCZiA-jn-3YzMHVpw8Vd70LMcjxrlF-oSQM5L_rXZIVsDnpXrBlh4RCamW9pXYYQEQWfByRjurmuKoQCVrX6yfY7zXwsofVSjfyP-7a3A2iYLxt8ZNNozBOz7UHDOrEbcmhZZZVQs8R4P8rlAlgPlM1SJPQZtjmnX1kw1iytlQeZDn55dp-IDrdeHcqiKrV038WgfQBsaO7TSbe8ShdUd5AjvTUm3XBCTASOtkli9Smn99rLNHNtYtkGoCDDbeUXvTfWt3T_uBTk0cS6wTeup0YVA-5SowmUP5zgrvUIXgZetzJJuFtpjnAL_sAfU6G9HsGubXF-pbmm2Xj4K02sDEBz3fvEIaYYNCTsB1zUcmBAS9bZBMvUFi4MnQSeWsX9qDqPa9JedeXnsfykXcn_I2z-xArFP4c8yIwAHhHP_qZYYWiCKyy6FQkuFUcVmW1YY22CxXwzvj3Jpr_KCU3opsRjL5zmN_lXia3Kr4s_T9sUvUFPrOeWP2ttYdM4A-320NIGJAmFNPdUBnZx5bJdBSZrwRkUMaFBb4M4LjtPNjesMQ3kAFiL2t08pbnMS2PTbs22REgdNduDTCcjTW71yhu-6TBgIh5CdY1AW8IhKRaBOLndLTKHfYL8LnTE2Y4eVr5qzhGs2_DuSlBNSACNYFaViWSnp6a6HJ7oGeQ_JE4EoXyvsb4yWcEdX6DERJJ7q6fK-kwvCcmH059CFej7TelGqXLxcHvOHlQydBaw6pbTIUZc-00OaSe-dLHoZDeIIMg94xtjf1C30jyGHODCfgt4owoD5wdMnTmLrXOZ48_orWxXyhCA9xN_4gqGRUAwnCQUn83g5cJ32LiuQlEi69zCGTYvHtPQwGeFnSR3HtOnsQKNgYariGoHdxs5rbvqyXB--KnxnMM04LJMDi0wIXsrtzCjbw7_auYJ1xOrNMh_Uu_syQUfEo_n47vfmPvasJvFZ2vTQYJU0-VTH6R_MpgA&cid=CAASEuRoHbXW2gWBLcz1Q9amZ3Fbgg&rfl=1%2Chttps%253A%252F%252Freturnsandrefund.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5975f21c81bda9dfd465bc96ee93a336e22d160bed0054ef916a8392d5aa406

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:17:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 12295082536333688880
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:17:48 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/ Frame 8977 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:04:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 803
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:04:57 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8977 0
575 B 83ms
57ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstfZY1Vbf0hGrbr2ZAy3TfXQBGx0RjVEpWgzyNaBR4mvc0cIk5UalfztnnYfXxbuvZDR0lwdlLcWL8c53KEDSySCNSqjj3JOd9LseNpNN5k1TaA-4weUl2bHJnv-wh8H3wl-fuJrNzig1l41Ddd7WFuOTpVzHuigoXiVqbB1gAo57iKW3MaE9zxkvVSKq6tlvihi657Gk35TMHbmiNijn9DszjNLLSGwNGGK141Lkr5KacvTum5SFDNtQk1zEJ43YhsQ8juNFCg0Ly1OysIQ7QMiaED904CsINRXvukgLNlrtbs56lyKcFus0cevvgzMmYWo7HbGWMClbdj68cxcGbrt2vc3zRdt2XbOQddcXBj2K6rE_jwi5iGgsD3uaRLoVnVYJU5O8LSihZf7cWfkmKqqMy_vmHAvGJA6lZY7dQ6KTur4zYpzPOGOQ9cr_8FB164xgeWVzyTGEqkesUAmSX87-52bsFhZjsnKu-g2sPAqF-HkMP89ukPpb_Z5PTY5vRHonZRwhgQoe1fEJ21kVeipf18vcLRxTDC8DTVyuldYPX_vYBm_h3TGDLlmvyQIaUySVVwwvdcHozrxCdsaKPU1-V4C2iqA_4eu86TNl0xVFY80r2-u_ZElsMwXnwsJYYWUwOqOmbZeQy3Ac5tZUK3M5ABox43XbYcs_VwYqHyF4s2oXaHym0pFZn65bSwkyjFD9B-RYtXwPoR-GWsxieOjvz6mhO7d92PVsIK4emDpsshrsN69RQRxixH3Y0_tx4_HAwBNO5UzCQQ_EYvv_BxXsY-ucZEwhrE-9GDOpawu1Z2TNrOILO1nz1hdGLtx63W0h7P_Pl_yykHk06h4uZz0fXu4aPm2DxiGWzEXqvCLzJBKxuqR_hfq30coPDHelGCcQR3bnHtEVdl8aQLC3Xq0NFmcvrOe5ud0AvwnF5oAFTMiW0p-ixMBwus1jGf-LNKv1FElvn-ewJVXrKylo2Sc6WrBZ6llfu3FPa8jDZ922Ji1LjfaAHxyq81Vx8fJQINNkRojM6POnvEVvKV2gEgrapFGR7X-GUDEfVW3TK5W1yj0D86wW16jeeIl5TiPvB7VzdVBlVQSrIJO59mV7nGJN9VlUr6C4Asr5Z1AtGS-gvleLB4jfP_BLifY1cxnEDI29_d6cJJL2YDmBcN6dzwzUeB7hRKBY-u971ca8hWfvSxOqRq8vqvRVOjO0cEmEwK3p5-DhiMhOj1tPAYref1R6dRbWK3RnQBM7dxdINb08mK1vkd&sai=AMfl-YSj4R0GajM576FPN5CXeAN0s9GxPmgzt-pOxg76YZXcaXc3pwfuxACebQByHHk5Iy8Ywu657YzKSje5416tzDkTghXoaV9TXGW1vkTBKt-d_cNE-M7J9Ss2vqqGTRc9_17_3WFAll6fNIJDNrwH4RBXHmnKGg&sig=Cg0ArKJSzNmCXumSSDByEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210603.38074&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 08 Jun 2021 18:18:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8977 41 KB
15 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:20:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43087
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:20:13 GMT

GET
H2 200 displayimage300x250gw_sellonsocial_de_bike_red_turnfollowers_img1.png
s0.2mdn.net/9331222/ Frame 8977 29 KB
29 KB 29ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9331222/displayimage300x250gw_sellonsocial_de_bike_red_turnfollowers_img1.png

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81a75a2d77510bd658fe16e31ce75d5f6cb34ad8806be17a7bfff078046cdb82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 16:09:04 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 13:06:26 GMT
server: sffe
age: 7756
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29639
x-xss-protection: 0
expires: Wed, 09 Jun 2021 16:09:04 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CBA2 1 KB
749 B 9ms
9ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 08 Jun 2021 05:40:48 GMT
expires: Wed, 09 Jun 2021 05:40:48 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 45452
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 8977 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 558928d140c5f6f65fd3e658f2a1158be194100c5a243d3d9c3fa3e8ba2f3397

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 9EA5 42 B
64 B 20ms
19ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsukVH-oHTGAJJRgTvgWGuINn5eXPCTjBedRguyhiIbK_j6Wix2vkMx33Y_WoqlyLmkhzHdEO01kD14f8rB4-Eu8h7tDdG5v7llMBVVW3S1j_3LjGhY9Qb2CzS5X-_EoFPAfF0IbNAxZsygMGwyc1zKU&sai=AMfl-YQIBojGDTt8dHG7-VzqIB3YmAfpfrxXSqa0HHrcsqQHe52CQP4XjMFa-1NFZ6PH_Qm-dwnON_xVisXRAzhHdfH6wqB_3_XD3hRIIwO1C54xwnYlrK52iTeaCZyl&sig=Cg0ArKJSzGFl4tsqmu8DEAE&cid=CAASF-Ro3hiCFqCqRRgzqH6_yphQn4nFYKJ4&id=ampim&o=315,1108&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1055&mtos=0,0,1055,1055,1055&tos=0,0,1055,0,0&tfs=423&tls=1478&g=100&h=100&tt=1478&r=v&avms=ampa&adk=3121120320

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 16ms
16ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbOTcwLDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMzg1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbOTcwLDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMzg1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=296; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8977 0
60 B 44ms
44ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B3B6 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 08 Jun 2021 14:44:09 GMT
expires: Wed, 08 Jun 2022 14:44:09 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 12851
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 18ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEzODUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=296; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBA2
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPEYeds_zUk5FgRnQjLYWmk&google_push=AYg5qPIzeana6s_u7LL4eJ-0sEUQJ1o3Gdtbp8DnMrV9s-rs_7iacbJR3u...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPEYeds_zUk5FgRnQjLYWmk&google_push=AYg5qPIzeana6s_u7LL4eJ-0sEUQJ1o3Gdtbp8DnMrV9s-rs_7iacbJR3u3JNyFAjIGI2NysAxLF9G4mfHfT5lxSxfkWggQefmrl

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1623176301.718029,VS0,VE92
x-served-by: cache-hhn4037-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEPEYeds_zUk5FgRnQjLYWmk&google_push=AYg5qPIzeana6s_u7LL4eJ-0sEUQJ1o3Gdtbp8DnMrV9s-rs_7iacbJR3u3JNyFAjIGI2NysAxLF9G4mfHfT5lxSxfkWggQefmrl
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBA2
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEEVK95uzU6Jc4QpuDXOuAnQ&google_cver=1&google_push=AYg5qPJJPyUZ4o95GLTDr1WdE42FL8tPZ784sIAUpwSrr68EnswxdiNQMevPlFYJvM0kkfoxIw4wyUptDajyRo_u2C6tjaMD2DmW
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=Q0MzOUU3RkYyNkYyQTE0MA==

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=Q0MzOUU3RkYyNkYyQTE0MA==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=Q0MzOUU3RkYyNkYyQTE0MA==
date: Tue, 08 Jun 2021 18:18:20 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBA2
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJjwPzxowAkfFcjFkAtBGco&google_cver=1&google_push=AYg5qPJI3yr8nNg1GJdxc2BEQg_oHTztlU4J5AHaQNzeWxww4Ue0e6HW_tAlgOAF6-FI96t9UI16kacYZk4SbDLzIzg9_hW...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJI3yr8nNg1GJdxc2BEQg_oHTztlU4J5AHaQNzeWxww4Ue0e6HW_tAlgOAF6-FI96t9UI16kacYZk4SbDLzIzg9_hW1HvVF&google_hm=Nzg4MDI1MDY2NTY2NTMxMD...

170 B
188 B

17ms
15ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJI3yr8nNg1GJdxc2BEQg_oHTztlU4J5AHaQNzeWxww4Ue0e6HW_tAlgOAF6-FI96t9UI16kacYZk4SbDLzIzg9_hW1HvVF&google_hm=Nzg4MDI1MDY2NTY2NTMxMDk0Mg%3D%3D

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 08 Jun 2021 18:18:20 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJI3yr8nNg1GJdxc2BEQg_oHTztlU4J5AHaQNzeWxww4Ue0e6HW_tAlgOAF6-FI96t9UI16kacYZk4SbDLzIzg9_hW1HvVF&google_hm=Nzg4MDI1MDY2NTY2NTMxMDk0Mg%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBA2
Redirect Chain

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESEGl03rKyLEa6qAmLIyWINEk&google_cver=1&google_push=AYg5qPKxeHzTOzQVriJ1d-Tz58Ui09akbIfSfeJ098lE7Bwx67blt0NS7842z8BbBDChf-6MMl_xLX0nuJRB4T8Fm6X8...
https://sync.bumlam.com/?src=ggl_nga&google_gid=CAESEGl03rKyLEa6qAmLIyWINEk&google_cver=1&google_push=AYg5qPKxeHzTOzQVriJ1d-Tz58Ui09akbIfSfeJ098lE7Bwx67blt0NS7842z8BbBDChf-6MMl_xLX0nuJRB4T8Fm6X8uzQ...
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPKxeHzTOzQVriJ1d-Tz58Ui09akbIfSfeJ098lE7Bwx67blt0NS7842z8BbBDChf-6MMl_xLX0nuJRB4T8Fm6X8uzQQiiVj

170 B
188 B

18ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPKxeHzTOzQVriJ1d-Tz58Ui09akbIfSfeJ098lE7Bwx67blt0NS7842z8BbBDChf-6MMl_xLX0nuJRB4T8Fm6X8uzQQiiVj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 08 Jun 2021 18:18:20 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPKxeHzTOzQVriJ1d-Tz58Ui09akbIfSfeJ098lE7Bwx67blt0NS7842z8BbBDChf-6MMl_xLX0nuJRB4T8Fm6X8uzQQiiVj
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBA2
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGt4BZOSDmeloT_1HHKXxhE&google_cver=1&google_push=AYg5qPKja4669KZCQf8xdooUlyKCsw1JPE-BxGRmgBo7Q562R8c1vNuWBIJRpoHokJlyzQK5yg-y23F6...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEGt4BZOSDmeloT_1HHKXxhE&google_cver=1&google_push=AYg5qPKja4669KZCQf8xdooUlyKCsw1JPE-BxGRmgBo7Q562R8c1vNuWBIJRpoHokJlyzQK5yg-...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQ2Nzk4MTQxNjExODYxODIwOQ&google_push=AYg5qPKja4669KZCQf8xdooUlyKCsw1JPE-BxGRmgBo7Q562R8c1vNuWBIJRpoHokJlyzQK5yg-y23...

170 B
188 B

16ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQ2Nzk4MTQxNjExODYxODIwOQ&google_push=AYg5qPKja4669KZCQf8xdooUlyKCsw1JPE-BxGRmgBo7Q562R8c1vNuWBIJRpoHokJlyzQK5yg-y23F6GwfcUqIOR0KQbZijliqf

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQ2Nzk4MTQxNjExODYxODIwOQ&google_push=AYg5qPKja4669KZCQf8xdooUlyKCsw1JPE-BxGRmgBo7Q562R8c1vNuWBIJRpoHokJlyzQK5yg-y23F6GwfcUqIOR0KQbZijliqf
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBA2
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=MfsvZFkGTlm4n2F3dTbNrw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

18ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=MfsvZFkGTlm4n2F3dTbNrw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLzE6M7UKQtpaj92J7-FvGtq6nIOtW0add0dr5Xnnglbm4yptkRFU-LFdKiejfQNLAC93M-1nPPPIvHfLh5NoHCOZQ0r_lm

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=MfsvZFkGTlm4n2F3dTbNrw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLzE6M7UKQtpaj92J7-FvGtq6nIOtW0add0dr5Xnnglbm4yptkRFU-LFdKiejfQNLAC93M-1nPPPIvHfLh5NoHCOZQ0r_lm
date: Tue, 08 Jun 2021 18:18:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBA2
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEP1y6lMgAiv7iAIddeoCh3Q&google_cver=1&google_push=AYg5qPKQzzYhPSdCpumSOMAEGpYXfGE7dFGmfd0FOde7Owa4U8PcFMxe8u-fT7CqwXjtskiw6CHHKjKae718R2rxq...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEP1y6lMgAiv7iAIddeoCh3Q&google_cver=1&google_push=AYg5qPKQzzYhPSdCpumSOMAEGpYXfGE7dFGmfd0FOde7Owa4U8PcFMxe8u-fT7CqwXjtskiw6CHHKjKae718R2rxq...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPKQzzYhPSdCpumSOMAEGpYXfGE7dFGmfd0FOde7Owa4U8PcFMxe8u-fT7CqwXjtskiw6CHHKjKae718R2rxqDz8Oy8JY7t6&google_hm=35b576b8409cc818f03222a9

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPKQzzYhPSdCpumSOMAEGpYXfGE7dFGmfd0FOde7Owa4U8PcFMxe8u-fT7CqwXjtskiw6CHHKjKae718R2rxqDz8Oy8JY7t6&google_hm=35b576b8409cc818f03222a9

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 08 Jun 2021 18:18:20 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPKQzzYhPSdCpumSOMAEGpYXfGE7dFGmfd0FOde7Owa4U8PcFMxe8u-fT7CqwXjtskiw6CHHKjKae718R2rxqDz8Oy8JY7t6&google_hm=35b576b8409cc818f03222a9
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame CBA2 0
12 B 16ms
16ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JMcjN6fAIpWqjQvbmayC-ghj354e9XLFOiWsGIBhejkwmzEDdHVYu4VUD9WVQCpNoyE7RJ

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js Show response
pagead2.googlesyndication.com/bg/ Frame B3B6 14 KB
6 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8047292d138b4f46fbe8493b4feed7d0e7777ffb56b3cc7ca0c7131ee9fe21f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 19:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 168478
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5749
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Jun 2022 19:30:22 GMT

GET
H3-29 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012105242203000/ Frame F309 191 KB
54 KB 30ms
10ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b90f60459b17f2ddf447768e249c21c662e70bde6148deff13643982f93f9a6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 387132
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55246
x-xss-protection: 0
server: sffe
date: Fri, 04 Jun 2021 06:46:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e9907e100ee706e0"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Jun 2022 06:46:08 GMT

GET
H3-29 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame F309 12 KB
4 KB 27ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8de063d7075aa9a9a68120f3eb37178e85777138d4154903a2d4b187b4a893d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 17995
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4568
x-xss-protection: 0
server: sffe
date: Tue, 08 Jun 2021 13:18:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b435c2fa80137a0e"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 13:18:25 GMT

GET
H3-29 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame F309 87 KB
27 KB 28ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12993a139a46e15abb56308ef8656d80812fb748dfa88116ee6e20ad3494ae98

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 43306
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27371
x-xss-protection: 0
server: sffe
date: Tue, 08 Jun 2021 06:16:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6687a81702b10306"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:16:34 GMT

GET
H3-29 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame F309 4 KB
2 KB 26ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de4196056e2ffb92e9e6eb78502d3ed77f71a1e8045434a907251ff0b998357

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 17995
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1521
x-xss-protection: 0
server: sffe
date: Tue, 08 Jun 2021 13:18:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5a9e085610d63d0a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 13:18:25 GMT

GET
H3-29 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012105242203000/v0/ Frame F309 41 KB
13 KB 37ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012105242203000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e53b8865f7f1e34e44d14f6ff8789dd7f421e7d3c69e48dab33188ff4d99f4e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 387134
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13132
x-xss-protection: 0
server: sffe
date: Fri, 04 Jun 2021 06:46:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1bd5431ac5ac76b7"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Jun 2022 06:46:06 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame F309 7 KB
741 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500|Roboto:300&lang=de

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

37d29979cc13eac68ee8339830a9685021bdb74db368b1a9bb0be3db71818d63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 17:45:36 GMT
server: ESF
date: Tue, 08 Jun 2021 18:18:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Jun 2021 18:18:20 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame F309 5 KB
688 B 30ms
28ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83e1fc06d61560e19649771db56bc018fc7fdb56e98f3a9f74505230a8f35060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 18:14:35 GMT
server: ESF
date: Tue, 08 Jun 2021 18:18:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Jun 2021 18:18:20 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F309 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 13:34:38 GMT
x-content-type-options: nosniff
server: cafe
age: 17022
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 09 Jun 2021 13:34:38 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F309 295 B
319 B 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 20:37:24 GMT
x-content-type-options: nosniff
server: cafe
age: 78056
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 08 Jun 2021 20:37:24 GMT

GET
DATA 200
OK truncated
/ Frame F309 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03e5f773173f2e9ae099b898132561d6d71b4f2b4b771c71b9e9ae1453be328b

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F309 0
0 43ms
42ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=ChzjpbLS_YLWRII-igAflwLrgDZ7VpJljobPX0bsMmJL4h7MCEAEg9PnGJWCV-vCBjAegAfLZ-IMDyAEGqQLhSqvxym20PuACAKgDAcgDCqoE4QFP0CgPntDHhm8ey7jv7bYwrnEyFTePZ8eaP2honeMwo3PZCtgg7ybuc_Oxirbt1I3jd03PDMdZfzLXL_t2TaXJvUHU2hycybqTTb-BC7nc0Z2b-_gF_TCfeeDJDIz-hSxN06NedxkJ722zXFvD1yUKyZGqgEKFuvTyfbJVm9IizFWp72iPXEU1imO9xevGBntYymOVaL87F9RHOihJ8XpzJOuAulH3WpY-BXjP4344c8qOYCwBCfJO8mosekSvKOub6RFj78456SuMujncgO9vTIM0nW1DLLCzCCi5wr-b6MLABLHw_66mAuAEAZIFBAgEGAGSBQQIBRgEoAY3gAf2pYd8qAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEELTKA9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNTg5MzI5NDQ2MjA2MTE0MIAKA8gLAdgTDYgUA9AVAYAXAbIXGgoYCAASFHB1Yi02Mzk2ODQ0NzQyNDk3MjA4&sigh=XyCr5KFP4aY&template_id=492
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29

200

B22989695.251332505;dc_pre=CJP1xPbSiPECFWrhuwgdUb4M8Q;dc_trk_aid=447717797;dc_trk_cid=119032232;ord=3763357134;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N297201.3159GOOGLE/ Frame F309
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N297201.3159GOOGLE/B22989695.251332505;dc_trk_aid=447717797;dc_trk_cid=119032232;ord=3763357134;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
https://ad.doubleclick.net/ddm/trackimp/N297201.3159GOOGLE/B22989695.251332505;dc_pre=CJP1xPbSiPECFWrhuwgdUb4M8Q;dc_trk_aid=447717797;dc_trk_cid=119032232;ord=3763357134;dc_lat=;dc_rdid=;tag_for_ch...

42 B
63 B

44ms
27ms

Image
image/gif

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N297201.3159GOOGLE/B22989695.251332505;dc_pre=CJP1xPbSiPECFWrhuwgdUb4M8Q;dc_trk_aid=447717797;dc_trk_cid=119032232;ord=3763357134;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N297201.3159GOOGLE/B22989695.251332505;dc_pre=CJP1xPbSiPECFWrhuwgdUb4M8Q;dc_trk_aid=447717797;dc_trk_cid=119032232;ord=3763357134;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame F309 0
0 15ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR6mnsMuhJBqSslwgD8xAe_LLjV4gVI6uGShj3ra5VMO0IIlcitLGcMUTyPk-9b0dE6H4Se2gjFKlpWFSlvdZXsA9AeFA
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 17ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODQ1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImI2Yzk4YThiYjE1NzY0ZjFjNGVlMzMxZGNiNzI0MTc4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMDg0NTMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDIyLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1MTYifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODQ1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODQ1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImI2Yzk4YThiYjE1NzY0ZjFjNGVlMzMxZGNiNzI0MTc4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMDg0NTMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDIyLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1MTYifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEwODQ1MzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=298; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 16ms
15ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 18ms
17ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=298; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 16ms
15ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2MzAxLCJhZF9wb3NpdGlvbiI6MTEwMSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjoxMjAsImJpZF9mbG9vcl9wcmV2IjoyMiwiYmlkX2Zsb29yX2ZpbGxlZCI6MiwiYXVjdGlvbl9jb3VudCI6NCwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6Mjg4LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTA4NDUzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2MzAxLCJhZF9wb3NpdGlvbiI6MTEwMSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjoxMjAsImJpZF9mbG9vcl9wcmV2IjoyMiwiYmlkX2Zsb29yX2ZpbGxlZCI6MiwiYXVjdGlvbl9jb3VudCI6NCwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6Mjg4LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=298; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame F309 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500|Roboto:300&lang=de

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://returnsandrefund.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 13:14:27 GMT
x-content-type-options: nosniff
age: 18233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 13:14:27 GMT

GET
H3-29 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame F309 44 KB
44 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500|Roboto:300&lang=de

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://returnsandrefund.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 10:59:25 GMT
x-content-type-options: nosniff
age: 26335
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45416
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 10:59:25 GMT

GET
H3-29 200 container.html Show response
1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BCEF 6 KB
3 KB 20ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://returnsandrefund.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://returnsandrefund.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 08 Jun 2021 18:18:15 GMT
expires: Wed, 08 Jun 2022 18:18:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 20ms
19ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMDczMzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Ijk0N2YxZDUxNjljYzdkMGY5OTc1NjBlMzQ4MzhmYjA0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTA3MzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTEtMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDQyLCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwNDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDcsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTA3MzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTEtMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MTcsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzUxNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExMDczMzAiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYyMzE3NjI5NCwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiN2I3YTIzZGQtMjA3OC00YjQ1LTZhNjEtNjUzNDU5ZTY4NGU3IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Ijk0N2YxZDUxNjljYzdkMGY5OTc1NjBlMzQ4MzhmYjA0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTA3MzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTEtMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDQyLCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwNDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDcsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTA3MzMwIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTEtMCIsInRfZXBvY2giOjE2MjMxNzYyOTQsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MTcsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzUxNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=340; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:20 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 10ms
9ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 08 Jun 2021 18:18:20 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 20ms
19ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI3YjdhMjNkZC0yMDc4LTRiNDUtNmE2MS02NTM0NTllNjg0ZTciLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0wOCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIwIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=340; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

GET
H2 200 army.gif Show response
returnsandrefund.com/porpoiseant/ 0
19 B 16ms
15ms XHR
text/plain 35.181.159.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2MzAxLCJhZF9wb3NpdGlvbiI6MTEwOCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjoyMDAsImJpZF9mbG9vcl9wcmV2Ijo3MCwiYmlkX2Zsb29yX2ZpbGxlZCI6NDIsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM2NSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/detroitchicago/cmb.js?gcb=194-2&cb=&01&00&03&04&0d&06&07&0a&0c&0e&14&18&23&25&01-100-303-1004-10d-506-507-70a-30c-30e-214-318-1223-125-21&cmbcb=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.181.159.169 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-181-159-169.eu-west-3.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTEwNzMzMCIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjIzMTc2Mjk0LCJhdWN0aW9uX2Vwb2NoIjoxNjIzMTc2MzAxLCJhZF9wb3NpdGlvbiI6MTEwOCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjdiN2EyM2RkLTIwNzgtNGI0NS02YTYxLTY1MzQ1OWU2ODRlNyIsImJpZF9mbG9vcl9pbml0aWFsIjoyMDAsImJpZF9mbG9vcl9wcmV2Ijo3MCwiYmlkX2Zsb29yX2ZpbGxlZCI6NDIsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM2NSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
pragma: no-cache
cookie: __gads=ID=aa9aabb52316cf4d:T=1623176295:S=ALNI_Mb0N2roA3Dt1ACUcoL4AduwdbZQ_g; ezouspvh=260; ezouspvv=340; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: returnsandrefund.com
referer: https://returnsandrefund.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://returnsandrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 07 Jun 2021 18:18:19 UTC

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame F309
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

39ms
39ms

Image
text/html

2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: returnsandrefund.com
URL: https://returnsandrefund.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Tue, 08 Jun 2021 18:18:20 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BAB3 624 B
297 B 37ms
35ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVWgBtYYEpjp4E8vgi-zDP5f2w8FI0-pG-hKE7kSpKgmAut-M9NYFErL2WnuKVc7ZLY_0s8f67LQP9g88dXvVEHX2cc7vUkV6NedS7iUjKihF1-J_Gifv87VdJ375mj4szxAojEaALYGlyA_uPVkyjuTPauXX7e9wjciex0NUzAD6s6Ncc5U6YCptv-45X8D-BpjAI6Xpz5UcLJjaIaZV7MBAmcgA

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVWgBtYYEpjp4E8vgi-zDP5f2w8FI0-pG-hKE7kSpKgmAut-M9NYFErL2WnuKVc7ZLY_0s8f67LQP9g88dXvVEHX2cc7vUkV6NedS7iUjKihF1-J_Gifv87VdJ375mj4szxAojEaALYGlyA_uPVkyjuTPauXX7e9wjciex0NUzAD6s6Ncc5U6YCptv-45X8D-BpjAI6Xpz5UcLJjaIaZV7MBAmcgA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUk94-lYJfG3RnEvO9Oj8CRHXbXFyGRAkedExTPrFFh60i-T_UFOm3xx9r8jPlg
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 08 Jun 2021 18:18:20 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BCEF 43 KB
21 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C0-NPTDKU9C8q6kxA1yh-U2Lqqa7coHwvliOdsjfLmApYT-RrTzMTBQ0acYWo9CogYbboUPHZjXmd4SwUxUb8bC18ejYTYtHJahgEhJlHgRfbB-VeDx6jEtplYwrLhTtJatlmsJvrgjDKREltK1NjWNyGMlw&dbm_d=AKAmf-D3MmvKlEBBArHez7cGyKJ07VxI0vcwV8Fw918KrDc0jFbSjUEL5rvSe7KN7hruC3WaSM0eiLP4ylBV_J5ye6-WgzwSs7SW3SFywbdI-pP5IL8rvwEaijHZtihpE84S8LXEY9TH_wM4hSKoanCfJ5009g3Yw0GfFjrIOkPyPlU6gt0d-CIIW5xXCE2mig2Pba739A-lz6EnWXDAN9Y4pbPngz2TpvcasL0mt3YswBACQKK8QIF-rQr2TuEeGTdEy1kFWE0zwJtU_LUWO1p_1AAzvx8zO6rHdJozu8o5Vse6o-Pm9tm8X5XyOzUHz0jxEnnjlGl4aGZXOKe7pvcl2F9Jt2LnXmHyDgW5Sx54_JYYc_5CBCM16iCZz5YwnE3v4Qx2YPsBr7oITUluFiD8k_bgAzpzBSmdPxVcPJEO0XrWEus1ue2DrUtYi2NdMXCF1QzYJRe0PAVWgE0rtlZ1am7dKUUohl3k1nJe45L6HJE8lhDm5JeewPV5CH9pR8TcPbnpq5T8E8_SbAIgxmvT1pxjbzl0a376hDp3LRe_J23PQ8CRGjk_9XjSZJS9EcN8hf5Qb-sLUH4IAIElyRV6lQuIpMt9XRb99m5hkLJDfQ-Zg0TZ0S-puAceRa3PjEHpLqSLdlmOyoXQALMfiS_kXG0ByOQpWfmU0Hl96Z5IbCTl1sjrQC8mtuuk4EZIxPBixf6BBVRuZee4NxcKRtPG9S2zEl6tduyhSXzRP0MhclsZxxkrRToEFjiSznkPOW2lL1XierGG6AYUpiD-IZTFIURa5eyzaEo0uoEuTeDSjiz3ar5DbPl3RsBXkxY69T_E20Kb2Pl-hjdo1WTIkaymZrOwR7svw1LdCAu5XPIlvmuuzNpMZNEQ5jRrd2TyY_lWF7ofa5AUGyIJLJi85TgKe7XFI0pzCwWJB62FCF1fpugSKjZ28FGgLMI4doUsWqvLdvyrOn-e07s8_XnL5Gix75fliR1Sb7RHMrG-L7cFCSPcNdCTstRNYulnJ38OsZMqaigGwugq493jISOPJvC6HQT2qvQlDeNyWEn8RkxOKsua08SGA3MAvbMVKacNScVfeeFipfHHn6VXAhMWcw5ulRKMoDcVDOrAaRuBzbItdR7pPY2bXZcL9q3dPWwE4m2u44FDeSR16t_XTxBPiKPHQJtct7eJ6tuh4PJrWgwbawojDvDpr2xKq8ZxfeqakXpSFySG3RJwj2CLkbA00xvbwzNQEG6ABbbD9f3O3ul9EQjX3-qb8_4-xPz56QonyRQ_6y4EZO-dg-A-QqPrcBwQhmLiPJ_9U_g4vLHnwEEUg1Oj_ShWVQ3wXyPqQ3BnYsoSstPilLWz20FFw-MMplvBuuwcbVI4TgM1t_a-IlGM0Kh8G2P4BNWvxFUTEOjdxZ0yQ6__DZgfw4pvodPd96DIgINGHfKH3iQGGUlVFtE0zFdh6gdyUbEPt8Rampw0zuy8xpH8BrGKYk0gbjpjJWcwN5I33aqFWfAcfpyYoyt_L3SutfxTPb8VDCzVN8Cui68ARHYeX5MZIZEuI2v7KfTvk_WlBdKmpzNKncNEmvGuFdRvfS0MJQFs-U9sx3LvWWYrzqIxGqWMESxTQsPxbJ3DNCPq46GDAeuKlOOymQ4WIX98jrBQzRQ83ZI3R1bLflVlY5sZ_8c4g1gg08jHiH8xGgkq7CNGYYlRzBBu1hhnjfs0v-AWqGimNXK7My5VKzFJlweJuC9ghx4nBlvDheBjkE3HJg2tFGmIjS0ptrFs_XqnRodTBKibXtYvPI_HNfTdR1N_ptlZ_2Lub1ql-uhnthRMH4-kXGvXsstgEwe4r-G0h7y8Up3YQWZt2zm7oTFF9D90fQQHs0Mdx4vlz6WW9HAH8EkSbancbotV3qxvr0Qc3vfIrNXLbEUlceCC4NOG_dVKHOsEubEKvkIq4d9FheYix_llNYu26oZuO1iYCv1hqgJ0HL_na9RMmrljQaVQ6ssbXiu5aPD3LeyMTW2hUFW4eAdZJWHNBXFpnvOz4aOrts0mClP1bD0gI4LWu4YxOZZWS-OcocBKFuAbLLG9cw6v5-uO13nPj6D6LF7QkWlqK6Cg9oRP_zatR2yrjiCUtABMd5mvGahAjVFspLk8QxOQ61QAsoMsZiN5SdCVd7TDgsH51f8iIedsH-I_YWde8ZoY2k4EzHk0L-I0tROyXS5evyN6RyIEDh5a6X4d9bQ2Gf2eXVGQ_dp9NahJmYiUk2oUwoxZqy00VBUDxjXktBj4lnvNz_McX5tYvuCzjJO_-x3G_c1zhWX8zqzbD10FwThYDP5ZkmPqnTe-E7G6e5DnWCjKZH0BI96yIW_peWxSmzjEK_JByajPGgNjHnXcwBS-y-JHAo0e2gfkBsGs_kEmjQGMhuAQQox41g9DkIdhYvEC8ZzA2ytGpZOzIKCDkKYOyMqE107aZ4MU5lubpz62H8vdHvCi-CoAtjjK33YknjJ7hekZJ9u8O8JNGkVa3DizZ-CPl7Uahxn9LEXiGODa8AO-SWW4_2pHKl1Nw9riYhnzgifFwkYeniNrVM6IH8jnqrrXTdpQd-auvUVmuY64BYvLfbNHSCEY47-vP-GSOypJzvWeb8fjkzLoK_4oZiDHO1p_24cJYbPBVMG1i7dWu-sFJp5MM1OdLtMMemgWf7goMCN5pj4Q5wiVLtpvRg0OgMmtKmziv0Ug2Baijvd1gF3XL1-dvQg9hTrbeLfkqZxnGJBFnP-cZPVOId-O2fmwTQ_GG1w9P4AZM1D2w0Hy8CbePVMvAIpVOH1i8EBFnuNPegOQtEQ0RLxwVYdUIV_Dnfd-cXjs53OsnEmpJ-i-O5QI1iXOfzrST98lYBkpNfF7OeflZ8ZekW8jB9tHznddfradR8WrXrzQPysPIIkcFq55KWYih1rOrOp42zO3_wOD7umb5WWBCU7UfiFZKf_yuyqGCvTt_xUOa7ZjZDpwRaliX-MQ6FJnGTUY_drY1KcPmYs&cid=CAASEuRoqQb0KAZ_3004P-fBBxQO7g&rfl=1%2Chttps%253A%252F%252Freturnsandrefund.com%252F%240

Requested by

Host: returnsandrefund.com
URL: https://returnsandrefund.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e171378d865b6cafecd5ffdafed7502927c0931ad43f5ba37053fdfdce8012c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21454
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BCEF 42 B
63 B 39ms
38ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A_9K4d_sZ6rxT0qsRxxOVf-rGzcjFMtZh3K2rVqhaEpSeVuA5DhHIZ6u_L8TqlBUt517ulrVStWdPvJF4hK_sMKs9yiCrM2Gkz4pHRnIx96cZA6So

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame BCEF 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:18:04 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BCEF 122 KB
37 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:18:20 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:18:20 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame BCEF 13 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:16:39 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/ Frame BCEF 22 KB
8 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C0-NPTDKU9C8q6kxA1yh-U2Lqqa7coHwvliOdsjfLmApYT-RrTzMTBQ0acYWo9CogYbboUPHZjXmd4SwUxUb8bC18ejYTYtHJahgEhJlHgRfbB-VeDx6jEtplYwrLhTtJatlmsJvrgjDKREltK1NjWNyGMlw&dbm_d=AKAmf-D3MmvKlEBBArHez7cGyKJ07VxI0vcwV8Fw918KrDc0jFbSjUEL5rvSe7KN7hruC3WaSM0eiLP4ylBV_J5ye6-WgzwSs7SW3SFywbdI-pP5IL8rvwEaijHZtihpE84S8LXEY9TH_wM4hSKoanCfJ5009g3Yw0GfFjrIOkPyPlU6gt0d-CIIW5xXCE2mig2Pba739A-lz6EnWXDAN9Y4pbPngz2TpvcasL0mt3YswBACQKK8QIF-rQr2TuEeGTdEy1kFWE0zwJtU_LUWO1p_1AAzvx8zO6rHdJozu8o5Vse6o-Pm9tm8X5XyOzUHz0jxEnnjlGl4aGZXOKe7pvcl2F9Jt2LnXmHyDgW5Sx54_JYYc_5CBCM16iCZz5YwnE3v4Qx2YPsBr7oITUluFiD8k_bgAzpzBSmdPxVcPJEO0XrWEus1ue2DrUtYi2NdMXCF1QzYJRe0PAVWgE0rtlZ1am7dKUUohl3k1nJe45L6HJE8lhDm5JeewPV5CH9pR8TcPbnpq5T8E8_SbAIgxmvT1pxjbzl0a376hDp3LRe_J23PQ8CRGjk_9XjSZJS9EcN8hf5Qb-sLUH4IAIElyRV6lQuIpMt9XRb99m5hkLJDfQ-Zg0TZ0S-puAceRa3PjEHpLqSLdlmOyoXQALMfiS_kXG0ByOQpWfmU0Hl96Z5IbCTl1sjrQC8mtuuk4EZIxPBixf6BBVRuZee4NxcKRtPG9S2zEl6tduyhSXzRP0MhclsZxxkrRToEFjiSznkPOW2lL1XierGG6AYUpiD-IZTFIURa5eyzaEo0uoEuTeDSjiz3ar5DbPl3RsBXkxY69T_E20Kb2Pl-hjdo1WTIkaymZrOwR7svw1LdCAu5XPIlvmuuzNpMZNEQ5jRrd2TyY_lWF7ofa5AUGyIJLJi85TgKe7XFI0pzCwWJB62FCF1fpugSKjZ28FGgLMI4doUsWqvLdvyrOn-e07s8_XnL5Gix75fliR1Sb7RHMrG-L7cFCSPcNdCTstRNYulnJ38OsZMqaigGwugq493jISOPJvC6HQT2qvQlDeNyWEn8RkxOKsua08SGA3MAvbMVKacNScVfeeFipfHHn6VXAhMWcw5ulRKMoDcVDOrAaRuBzbItdR7pPY2bXZcL9q3dPWwE4m2u44FDeSR16t_XTxBPiKPHQJtct7eJ6tuh4PJrWgwbawojDvDpr2xKq8ZxfeqakXpSFySG3RJwj2CLkbA00xvbwzNQEG6ABbbD9f3O3ul9EQjX3-qb8_4-xPz56QonyRQ_6y4EZO-dg-A-QqPrcBwQhmLiPJ_9U_g4vLHnwEEUg1Oj_ShWVQ3wXyPqQ3BnYsoSstPilLWz20FFw-MMplvBuuwcbVI4TgM1t_a-IlGM0Kh8G2P4BNWvxFUTEOjdxZ0yQ6__DZgfw4pvodPd96DIgINGHfKH3iQGGUlVFtE0zFdh6gdyUbEPt8Rampw0zuy8xpH8BrGKYk0gbjpjJWcwN5I33aqFWfAcfpyYoyt_L3SutfxTPb8VDCzVN8Cui68ARHYeX5MZIZEuI2v7KfTvk_WlBdKmpzNKncNEmvGuFdRvfS0MJQFs-U9sx3LvWWYrzqIxGqWMESxTQsPxbJ3DNCPq46GDAeuKlOOymQ4WIX98jrBQzRQ83ZI3R1bLflVlY5sZ_8c4g1gg08jHiH8xGgkq7CNGYYlRzBBu1hhnjfs0v-AWqGimNXK7My5VKzFJlweJuC9ghx4nBlvDheBjkE3HJg2tFGmIjS0ptrFs_XqnRodTBKibXtYvPI_HNfTdR1N_ptlZ_2Lub1ql-uhnthRMH4-kXGvXsstgEwe4r-G0h7y8Up3YQWZt2zm7oTFF9D90fQQHs0Mdx4vlz6WW9HAH8EkSbancbotV3qxvr0Qc3vfIrNXLbEUlceCC4NOG_dVKHOsEubEKvkIq4d9FheYix_llNYu26oZuO1iYCv1hqgJ0HL_na9RMmrljQaVQ6ssbXiu5aPD3LeyMTW2hUFW4eAdZJWHNBXFpnvOz4aOrts0mClP1bD0gI4LWu4YxOZZWS-OcocBKFuAbLLG9cw6v5-uO13nPj6D6LF7QkWlqK6Cg9oRP_zatR2yrjiCUtABMd5mvGahAjVFspLk8QxOQ61QAsoMsZiN5SdCVd7TDgsH51f8iIedsH-I_YWde8ZoY2k4EzHk0L-I0tROyXS5evyN6RyIEDh5a6X4d9bQ2Gf2eXVGQ_dp9NahJmYiUk2oUwoxZqy00VBUDxjXktBj4lnvNz_McX5tYvuCzjJO_-x3G_c1zhWX8zqzbD10FwThYDP5ZkmPqnTe-E7G6e5DnWCjKZH0BI96yIW_peWxSmzjEK_JByajPGgNjHnXcwBS-y-JHAo0e2gfkBsGs_kEmjQGMhuAQQox41g9DkIdhYvEC8ZzA2ytGpZOzIKCDkKYOyMqE107aZ4MU5lubpz62H8vdHvCi-CoAtjjK33YknjJ7hekZJ9u8O8JNGkVa3DizZ-CPl7Uahxn9LEXiGODa8AO-SWW4_2pHKl1Nw9riYhnzgifFwkYeniNrVM6IH8jnqrrXTdpQd-auvUVmuY64BYvLfbNHSCEY47-vP-GSOypJzvWeb8fjkzLoK_4oZiDHO1p_24cJYbPBVMG1i7dWu-sFJp5MM1OdLtMMemgWf7goMCN5pj4Q5wiVLtpvRg0OgMmtKmziv0Ug2Baijvd1gF3XL1-dvQg9hTrbeLfkqZxnGJBFnP-cZPVOId-O2fmwTQ_GG1w9P4AZM1D2w0Hy8CbePVMvAIpVOH1i8EBFnuNPegOQtEQ0RLxwVYdUIV_Dnfd-cXjs53OsnEmpJ-i-O5QI1iXOfzrST98lYBkpNfF7OeflZ8ZekW8jB9tHznddfradR8WrXrzQPysPIIkcFq55KWYih1rOrOp42zO3_wOD7umb5WWBCU7UfiFZKf_yuyqGCvTt_xUOa7ZjZDpwRaliX-MQ6FJnGTUY_drY1KcPmYs&cid=CAASEuRoqQb0KAZ_3004P-fBBxQO7g&rfl=1%2Chttps%253A%252F%252Freturnsandrefund.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5975f21c81bda9dfd465bc96ee93a336e22d160bed0054ef916a8392d5aa406

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:17:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 12295082536333688880
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:17:48 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/ Frame BCEF 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 18:04:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 804
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 18:04:57 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame BCEF 0
24 B 72ms
49ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssgvYWDoGVOBsJJINI7MaRwGAFlAD4okwAV8G2eK1_raiWLs8UHIwI4gjE-dQJO345XHxjwjFcQaR4iggPObgLEr9fSENlsPVhKJ4MusuvjBD6KXO71KNS3wW6w2nnds7CReLOPSyG95OCMAjR63KXbOCLdF7pVuaii08oHhw_fPq2J6rZ5q2tz2-dmgLJIsl3ulkwIXw1e-T4PztQFNF4ieC-2wf24bb0nR02V3D1ZT6OTeC2zFHwFtFMiKjDApDyHsqG92P_sDyiVelmopfqiHGODtOORW1S-YXTRfI7RGbioZXkbbgGOpc0kXQv-E33bi3NGxQD57X0oYj4DDsGVS5iq8PGk9C96-HzIdNWZ5aEyJmyf4tytUlyFWv0BadTLrA1dpR3dXv3ecIWj2z6GgbMp5_iw-K__9udgxDxx2JoV0mS3J9pwzmi1NWrPp4mJ8ZFN2jqwbZH171HtfpH3cEzUSJnDaNMCpV7_yx2qVTmMxDSiNhrz1tZXRgy_kJzeGjqvVheFD8FCghAixKyk4hj2h0ggoW9yt6Fys2-vE61Bae4W_ogymrekAOEYt0sMKrYq9o9eqrVu06sDWA_CL6xpp-PlIb6xDbmb9-BxNAT_8yBks9gGdYAs1y8oIes9v-AmCk4nPpYEX9Sc0P-ptMre2xPOX7fDLsAxRY-C9Oz0guo_b4-8crHUFr9ZImmkA24J5TefzSrmB8IlbEMu30sUEPI9AeZ5pPrZsadj8RXOdfbZ-bwZHtn_wkvUQAYPmW7rhkcOoQkEx6sXpi5vXb9elLF7FRksJZp0zTPiejPx4jTjX9sRb1YYedQCXTYLDnNrV2pgRqmAqm60804LDtxZPQxHPH4Qme5oRijBEixfZTUggwcfWbGKLyijBocHJZRTdBuYD413xwsj_IP7YgAU40pSh791A7BhZTxkuWz2hyBzKxRr2CXQmfHCJEY6n9DiLHBGdOWPoREU200vObGWnYmnLWy15Qddiv7YV7dwzYZh-ImfxomJtAGsyjM72QBoZmhPADFQx5LWMTywHmHi6DZ2ZTgi9GIhzfv4AkW8NGeBJTh8iTw_OnQ_r5k6qq7P5c0MGSLjrqnfZCndxeViw5hv8R-p9ZRIL3B9qlcgPy3DShQl6GdtwERc80vOEp4v9E2aKS09pwKuCKeA7nQRwZRu_EHMI7nmdm6kQYMozt0k-ZyrpaIi7SobfJ1PxySdh0zLi2CMUtrpXpmA_bTJNPC21FIgxHpMchYJLcYWPfY153QcLH_yZg&sai=AMfl-YRl9E44Z4CzvEa30yYp6PNhmrVwR_KTTcOXFgqm9cNBV1_BcBwReMBDqeNicjnVw0fTdP_Q7ItNRKSpJ_fWJuVkeBKM5xuc1BlvL1JgdrMYJ4cM3MS1dZIDZPMuter0MYHHZh7dw2a7O8obdo9ObKubE7_Y9A&sig=Cg0ArKJSzLS0S0egO6_MEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210603.58215&adurl=

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 08 Jun 2021 18:18:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BCEF 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:20:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43088
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:20:13 GMT

GET
H3-29 200 displayimage300x250gw_sellonsocial_de_bike_yellow_turnfollowers_img1.png
s0.2mdn.net/9331222/ Frame BCEF 29 KB
29 KB 20ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9331222/displayimage300x250gw_sellonsocial_de_bike_yellow_turnfollowers_img1.png

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d323b04109d6f43b39532bb2a4e59f7563def3874bd91cff00ec8915cb228c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 16:35:40 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 13:06:29 GMT
server: sffe
age: 6161
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29832
x-xss-protection: 0
expires: Wed, 09 Jun 2021 16:35:40 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BAB3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1

43 B
894 B

13ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVWgBtYYEpjp4E8vgi-zDP5f2w8FI0-pG-hKE7kSpKgmAut-M9NYFErL2WnuKVc7ZLY_0s8f67LQP9g88dXvVEHX2cc7vUkV6NedS7iUjKihF1-J_Gifv87VdJ375mj4szxAojEaALYGlyA_uPVkyjuTPauXX7e9wjciex0NUzAD6s6Ncc5U6YCptv-45X8D-BpjAI6Xpz5UcLJjaIaZV7MBAmcgA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:21 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 18:18:21 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BAB3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL.0bFUHSMQtr4tx7xfgIwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1&google_hm=2

43 B
894 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVWgBtYYEpjp4E8vgi-zDP5f2w8FI0-pG-hKE7kSpKgmAut-M9NYFErL2WnuKVc7ZLY_0s8f67LQP9g88dXvVEHX2cc7vUkV6NedS7iUjKihF1-J_Gifv87VdJ375mj4szxAojEaALYGlyA_uPVkyjuTPauXX7e9wjciex0NUzAD6s6Ncc5U6YCptv-45X8D-BpjAI6Xpz5UcLJjaIaZV7MBAmcgA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:21 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 18:18:21 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM22wulWNANpjwER3EvfkoE&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame BAB3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHxuweNVr6SmEbAEbEPnDp0&google_cver=1

43 B
1 KB

8ms
7ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHxuweNVr6SmEbAEbEPnDp0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQpb6JAhjm5fqnATAB&v=APEucNVWgBtYYEpjp4E8vgi-zDP5f2w8FI0-pG-hKE7kSpKgmAut-M9NYFErL2WnuKVc7ZLY_0s8f67LQP9g88dXvVEHX2cc7vUkV6NedS7iUjKihF1-J_Gifv87VdJ375mj4szxAojEaALYGlyA_uPVkyjuTPauXX7e9wjciex0NUzAD6s6Ncc5U6YCptv-45X8D-BpjAI6Xpz5UcLJjaIaZV7MBAmcgA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:21 GMT
X-Proxy-Origin: 152.89.163.156; 152.89.163.156; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.155:80
AN-X-Request-Uuid: 167b5071-65b9-4256-bcf5-d27e3984703f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHxuweNVr6SmEbAEbEPnDp0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BAB3
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwNTI2MzE4MzQ3OTIwMDgxOQ%3D%3D

170 B
188 B

16ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwNTI2MzE4MzQ3OTIwMDgxOQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 18:18:21 GMT
X-Proxy-Origin: 152.89.163.156; 152.89.163.156; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.155:80
AN-X-Request-Uuid: 61ab245c-2f75-47ca-8ada-9920c1ea8e4c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwNTI2MzE4MzQ3OTIwMDgxOQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame BCEF 0
23 B 43ms
42ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 18:18:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CE7A 1 KB
749 B 6ms
5ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 08 Jun 2021 05:40:48 GMT
expires: Wed, 09 Jun 2021 05:40:48 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 45453
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame BCEF 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a1f2ad0c8415aeac180e48cd413297ff3ac41eef6e9f44834dda129a13596f5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3581 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 08 Jun 2021 14:44:09 GMT
expires: Wed, 08 Jun 2022 14:44:09 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 12852
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CE7A
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEBmJZSFrijXKW6tbC-RI2uI&google_cver=1&google_push=AYg5qPKQQb3cdoO-dTzwzaXESptUtZtsnNSnbztsDxwJVxOuQg3aI1GI-UVAP_FolqruU_e9oxy9O8xTxmNW__BasQJ7...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEBmJZSFrijXKW6tbC-RI2uI&google_cver=1&google_push=AYg5qPKQQb3cdoO-dTzwzaXESptUtZtsnNSnbztsDxwJVxOuQg3aI1GI-UVAP_FolqruU_e9oxy9O8xTxmNW__...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKQQb3cdoO-dTzwzaXESptUtZtsnNSnbztsDxwJVxOuQg3aI1GI-UVAP_FolqruU_e9oxy9O8xTxmNW__BasQJ7lWqusvM&google_hm=1eWQyqANTyeKjU8Ev3wV9w==

170 B
188 B

16ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKQQb3cdoO-dTzwzaXESptUtZtsnNSnbztsDxwJVxOuQg3aI1GI-UVAP_FolqruU_e9oxy9O8xTxmNW__BasQJ7lWqusvM&google_hm=1eWQyqANTyeKjU8Ev3wV9w==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKQQb3cdoO-dTzwzaXESptUtZtsnNSnbztsDxwJVxOuQg3aI1GI-UVAP_FolqruU_e9oxy9O8xTxmNW__BasQJ7lWqusvM&google_hm=1eWQyqANTyeKjU8Ev3wV9w==
date: Tue, 08 Jun 2021 18:18:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CE7A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHh8a5NAdrtITd9sV9O8w5c&google_cver=1&google_push=AYg5qPLi7mUgHNyaJsz0XKQeqDAe0ic3SrLFs5cOGsxtnM5X6bnYNq9S3YLFChHg-Ioo80SMu7e...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BPRDlETkotMVEtSFVaMw==&google_push=AYg5qPLi7mUgHNyaJsz0XKQeqDAe0ic3SrLFs5cOGsxtnM5X6bnYNq9S3YLFChHg-Ioo80SMu7e8S-c0JLi4luobGdrnXWtCHtk

170 B
188 B

16ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BPRDlETkotMVEtSFVaMw==&google_push=AYg5qPLi7mUgHNyaJsz0XKQeqDAe0ic3SrLFs5cOGsxtnM5X6bnYNq9S3YLFChHg-Ioo80SMu7e8S-c0JLi4luobGdrnXWtCHtk

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BPRDlETkotMVEtSFVaMw==&google_push=AYg5qPLi7mUgHNyaJsz0XKQeqDAe0ic3SrLFs5cOGsxtnM5X6bnYNq9S3YLFChHg-Ioo80SMu7e8S-c0JLi4luobGdrnXWtCHtk
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame CE7A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAqUgPGANDLHM7SB_2xFiY0&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL-0bFUHSMQtr4tx7xfgIwAABJsAAAIB&google_push=AYg5qPIP5n-0nCfMMthe1TqG0fC0z7RYxE2ih_Gm9jIdanRcOpZIo4o9j_LG0vHPa28m2JjqHjZSzMAhGk1hHM0tDB...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CE7A
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEO7Eovo9DykQU7PZYjB8gB4&google_cver=1&google_push=AYg5qPJ2FXsu5Wy9l_L_GKdJWKmE9GnQ-_6zcpscpHj80EFVZRqp0fJvt3cCQWv5-NA89k0AK43ynjEFrFLYJU0r...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJ2FXsu5Wy9l_L_GKdJWKmE9GnQ-_6zcpscpHj80EFVZRqp0fJvt3cCQWv5-NA89k0AK43ynjEFrFLYJU0rm3inU7962A

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJ2FXsu5Wy9l_L_GKdJWKmE9GnQ-_6zcpscpHj80EFVZRqp0fJvt3cCQWv5-NA89k0AK43ynjEFrFLYJU0rm3inU7962A

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 08 Jun 2021 18:18:21 GMT
via: 1.1 24e6529ea30fbe719bde2164c1fe9238.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: CDG50-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJ2FXsu5Wy9l_L_GKdJWKmE9GnQ-_6zcpscpHj80EFVZRqp0fJvt3cCQWv5-NA89k0AK43ynjEFrFLYJU0rm3inU7962A
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: g29B2pCm3WwJorp12Cb605zlzVGX1aDw9-__hKhm3RDw6TkFZFeTaQ==

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CE7A
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBgukwRoxGqZkRsuzfktf8I&google_cver=1&google_push=AYg5qPL4o4Yu2crRNA72pM4BMz1hC6IwZcTtUBv4aVihm4dsy1GCczJhgH01EGoBgrGCNRhkxYwusQ...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPL4o4Yu2crRNA72pM4BMz1hC6IwZcTtUBv4aVihm4dsy1GCczJhgH01EGoBgrGCNRhkxYwusQ5v1urgiphURIQP_oPa9w&google_hm=ODYwOTMzODk2...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPL4o4Yu2crRNA72pM4BMz1hC6IwZcTtUBv4aVihm4dsy1GCczJhgH01EGoBgrGCNRhkxYwusQ5v1urgiphURIQP_oPa9w&google_hm=ODYwOTMzODk2NjY3Mzk2Nzc4MA%3D%3D

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPL4o4Yu2crRNA72pM4BMz1hC6IwZcTtUBv4aVihm4dsy1GCczJhgH01EGoBgrGCNRhkxYwusQ5v1urgiphURIQP_oPa9w&google_hm=ODYwOTMzODk2NjY3Mzk2Nzc4MA%3D%3D
date: Tue, 08 Jun 2021 18:18:20 GMT
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CE7A
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEOjaKIDBaDXzMuOmxax-jyw&google_cver=1&google_push=AYg5qPLwSKdxUotdpNQfVo7rVS1p7DsTOJe73JVns40QcZvttbXPail6...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEOjaKIDBaDXzMuOmxax-jyw&google_cver=1&google_push=AYg5qPLwSKdxUotdpNQfVo7rVS1p7DsTOJe73JVns40QcZvttbXPail6...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEOjaKIDBaDXzMuOmxax-jyw&google_cver=1&google_push=AYg5qPLwSKdxUotdpNQfVo7rVS1p7DsTOJe73JVns40QcZvttbXPai...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBlN2UxZWE1ZC1jODg1LTExZWItYTdhMi0wMjhiMDA5ZmQ0ZDA%3D&google_push=AYg5qPLwSKdxUotdpNQfVo7rVS1p7DsTOJe73JVns40QcZvttbXPail6j7FVLkHpGN...

170 B
188 B

16ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBlN2UxZWE1ZC1jODg1LTExZWItYTdhMi0wMjhiMDA5ZmQ0ZDA%3D&google_push=AYg5qPLwSKdxUotdpNQfVo7rVS1p7DsTOJe73JVns40QcZvttbXPail6j7FVLkHpGNQFNUZzcFGUVvFoKyi09Rr3B2uq_wb0_ic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 08 Jun 2021 18:18:21 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBlN2UxZWE1ZC1jODg1LTExZWItYTdhMi0wMjhiMDA5ZmQ0ZDA%3D&google_push=AYg5qPLwSKdxUotdpNQfVo7rVS1p7DsTOJe73JVns40QcZvttbXPail6j7FVLkHpGNQFNUZzcFGUVvFoKyi09Rr3B2uq_wb0_ic
Connection: keep-alive
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CE7A
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEPupflNWmD6XLQH7qihCuzw&google_cver=1&google_push=AYg5qPK-8Dv_eQuQuOhql38LNHN8jbXLCv_KiSGMMfbnsliPE2xlznCgFbyG0vPcXo46ngbPkuaDjkKD0eOURZCoW...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MjMwYTUyYTAtNzYzYS00YmFiLTgzNTMtOTI4MWU5MGY5YmVl&google_push=AYg5qPK-8Dv_eQuQuOhql38LNHN8jbXLCv_KiSGMMfbnsliPE2xlznCgFbyG0vPc...

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MjMwYTUyYTAtNzYzYS00YmFiLTgzNTMtOTI4MWU5MGY5YmVl&google_push=AYg5qPK-8Dv_eQuQuOhql38LNHN8jbXLCv_KiSGMMfbnsliPE2xlznCgFbyG0vPcXo46ngbPkuaDjkKD0eOURZCoWcY_G0TeJmiL

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 18:18:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MjMwYTUyYTAtNzYzYS00YmFiLTgzNTMtOTI4MWU5MGY5YmVl&google_push=AYg5qPK-8Dv_eQuQuOhql38LNHN8jbXLCv_KiSGMMfbnsliPE2xlznCgFbyG0vPcXo46ngbPkuaDjkKD0eOURZCoWcY_G0TeJmiL
date: Tue, 08 Jun 2021 18:18:21 GMT
content-length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame CE7A 0
12 B 16ms
14ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ix_arHf2OHchHAbyUD0KyufXHOHr0hLOiwJeZWW7bgxTTCBMG8QhHF1OpUKSg_nDt6vFw0jw4

Requested by

Host: 1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com
URL: https://1166a4cd3ab502dde652a4d6e6e2d6db.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS