prnt.sc Open in urlscan Pro
104.26.15.80 Public Scan

URL:
https://prnt.sc/14oeka3
Submission: On June 09 via manual (June 9th 2021, 7:28:18 am UTC) from IN

Summary HTTP 219 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 35 IPs in 5 countries across 22 domains to perform 219 HTTP transactions. The main IP is 104.26.15.80, located in United States and belongs to CLOUDFLARENET, US. The main domain is prnt.sc.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2020. Valid for: a year.

This is the only time prnt.sc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	104.26.15.80 104.26.15.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	104.23.139.12 104.23.139.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.23.140.12 104.23.140.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
2	2600:9000:218... 2600:9000:218c:f800:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
2	151.139.242.3 151.139.242.3	33438 (HIGHWINDS2) (HIGHWINDS2)
12	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c0a::9d	15169 (GOOGLE) (GOOGLE)
1	2600:9000:211... 2600:9000:211e:bc00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	192.207.255.147 192.207.255.147	62821 (AS-MNX) (AS-MNX)
2	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
5	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
4	52.222.200.121 52.222.200.121	16509 (AMAZON-02) (AMAZON-02)
1	2.21.111.28 2.21.111.28	16625 (AKAMAI-AS) (AKAMAI-AS)
2	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
9 18	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
9 15	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
9 12	37.252.172.36 37.252.172.36	29990 (ASN-APPNEX) (ASN-APPNEX)
39	2a00:1450:400... 2a00:1450:4001:831::2006	15169 (GOOGLE) (GOOGLE)
38	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
2	52.50.244.146 52.50.244.146	16509 (AMAZON-02) (AMAZON-02)
2	18.132.66.136 18.132.66.136	16509 (AMAZON-02) (AMAZON-02)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
219	35

2 104.26.15.80 (United States)

ASN13335 (CLOUDFLARENET, US)

prnt.sc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.23.139.12 (United States)

ASN13335 (CLOUDFLARENET, US)

st.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.23.140.12 (United States)

ASN13335 (CLOUDFLARENET, US)

image.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
st.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:218c:f800:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.242.3 (United States)

ASN33438 (HIGHWINDS2, US)

cdn.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
scontent-frt3-2.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0a::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:bc00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.207.255.147 (United States)

ASN62821 (AS-MNX, US)
PTR: haproxy2.ad4game.com

ads.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.222.200.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-200-121.cdg50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.111.28 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-111-28.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 172.217.23.98 (United States) 9 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2.18.234.21 (Frankfurt am Main, Germany) 9 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 37.252.172.36 (Frankfurt am Main, Germany) 9 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a00:1450:4001:831::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

38 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
havasfrorangedcmdisplay758646212611.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.50.244.146 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-244-146.eu-west-1.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.132.66.136 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-132-66-136.eu-west-2.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	2mdn.net s0.2mdn.net	219 KB
39	googlesyndication.com d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	178 KB
27	doubleclick.net 9 redirects stats.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	200 KB
24	moatads.com z.moatads.com geo.moatads.com mb.moatads.com px.moatads.com	216 KB
20	prntscr.com st.prntscr.com image.prntscr.com api.prntscr.com	174 KB
18	moatpixel.com havasfrorangedcmdisplay758646212611.s.moatpixel.com	5 KB
16	casalemedia.com 9 redirects htlb.casalemedia.com dsum-sec.casalemedia.com	14 KB
12	adnxs.com 9 redirects ib.adnxs.com	11 KB
10	fbcdn.net static.xx.fbcdn.net scontent-frt3-2.xx.fbcdn.net	184 KB
6	twitter.com platform.twitter.com syndication.twitter.com	148 KB
5	googletagservices.com www.googletagservices.com	160 KB
4	amazon-adsystem.com c.amazon-adsystem.com	36 KB
4	facebook.com www.facebook.com	15 KB
4	google.com www.google.com adservice.google.com	1 KB
4	ad4game.com cdn.ad4game.com ads.ad4game.com	105 KB
2	google.de www.google.de adservice.google.de	1 KB
2	quantcount.com rules.quantcount.com pixel.quantcount.com	555 B
2	facebook.net connect.facebook.net	67 KB
2	consensu.org quantcast.mgr.consensu.org	61 KB
2	google-analytics.com www.google-analytics.com	20 KB
2	prnt.sc prnt.sc	21 KB
1	quantserve.com secure.quantserve.com	9 KB
219	22

	Domain	Requested by
39	s0.2mdn.net	d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com prnt.sc s0.2mdn.net
20	pagead2.googlesyndication.com	securepubads.g.doubleclick.net prnt.sc d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
18	havasfrorangedcmdisplay758646212611.s.moatpixel.com	d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
18	px.moatads.com	d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
17	st.prntscr.com	prnt.sc st.prntscr.com
15	dsum-sec.casalemedia.com	9 redirects googleads.g.doubleclick.net
14	tpc.googlesyndication.com	prnt.sc d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com securepubads.g.doubleclick.net tpc.googlesyndication.com googleads.g.doubleclick.net
12	ib.adnxs.com	9 redirects googleads.g.doubleclick.net
12	cm.g.doubleclick.net	9 redirects googleads.g.doubleclick.net
8	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
6	googleads4.g.doubleclick.net	googleads.g.doubleclick.net prnt.sc
6	googleads.g.doubleclick.net	prnt.sc d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
5	www.googletagservices.com	ads.ad4game.com securepubads.g.doubleclick.net prnt.sc d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
4	d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	c.amazon-adsystem.com	ads.ad4game.com c.amazon-adsystem.com
4	www.facebook.com	connect.facebook.net
4	platform.twitter.com	prnt.sc platform.twitter.com
3	www.google.com	prnt.sc tpc.googlesyndication.com
2	mb.moatads.com	z.moatads.com
2	geo.moatads.com	z.moatads.com
2	z.moatads.com	s0.2mdn.net
2	scontent-frt3-2.xx.fbcdn.net	www.facebook.com
2	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	syndication.twitter.com	platform.twitter.com prnt.sc
2	ads.ad4game.com	cdn.ad4game.com
2	connect.facebook.net	prnt.sc connect.facebook.net
2	api.prntscr.com	st.prntscr.com
2	cdn.ad4game.com	prnt.sc cdn.ad4game.com
2	quantcast.mgr.consensu.org	prnt.sc quantcast.mgr.consensu.org
2	www.google-analytics.com	prnt.sc www.google-analytics.com
2	prnt.sc	prnt.sc
1	ade.googlesyndication.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	htlb.casalemedia.com	cdn.ad4game.com
1	pixel.quantcount.com	prnt.sc
1	www.google.de	prnt.sc
1	rules.quantcount.com	secure.quantserve.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	secure.quantserve.com	quantcast.mgr.consensu.org
1	image.prntscr.com	prnt.sc
219	41

This site contains links to these domains. Also see Links.

Domain
app.prntscr.com
prntscr.com
twitter.com
www.facebook.com
www.google.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-18` - `2021-07-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
quantcast.mgr.consensu.org Amazon	`2021-04-24` - `2022-05-23`	a year	crt.sh
*.ad4game.com Go Daddy Secure Certificate Authority - G2	`2019-11-17` - `2022-01-16`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-05-26` - `2021-08-24`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-30` - `2021-11-29`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.google.de GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-25` - `2022-06-25`	a year	crt.sh

This page contains 21 frames:

Primary Page: https://prnt.sc/14oeka3
Frame ID: B8B38E2FC696A2CD4F349A2B4DF59E17
Requests: 58 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fprnt.sc
Frame ID: 652E5852C6E0A125DA67DE3284843E2A
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.06c6ee58c3810956b7509218508c7b56.en.html
Frame ID: 0A5A9F9790BE51EB069321D1C2D2546F
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df258453ed8dc7ec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2F14oeka3&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
Frame ID: 38400EEB39E9F288E28077BDC42B33A7
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df107455086d6f38%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2F14oeka3&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=14oeka3
Frame ID: F8DF62DA5A36E8C43B8334C96C53BA2E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1177771c9530a8%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Frame ID: ED15858EA4988DEBF34E3D9A3CCBCEC8
Requests: 11 HTTP requests in this frame

Frame: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: F72B2EF4B836F0C79416191A78C59667
Requests: 21 HTTP requests in this frame

Frame: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 4F63B7BFF0173E42C90195BA046258BE
Requests: 21 HTTP requests in this frame

Frame: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: CA868BE368479ACFABDE01004932FCB6
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNW5_6Pl30gciA8YvnfC8Y8S4LVKJkagoXAEm6reB1W5akIjPeMhHBeAZ_iRjOkvYqzUmGXtnB52D7rzeBdsz2wUfR5N7tzcyEJexmejGh5qOaATx_MU2Gbe2WHM04JTMvh4QCuGnk3QsLq9fmFsOtdGRmkpBr5-v0Nw3f4dO1agbSBDiik
Frame ID: CBEC959606454AF07855036791AD5574
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BRUIMjdsG6O0b3R7jdD_qnJohNERFOz9eLUNW5oWJ62nfkLxVmVjN-lUB-x4xJc_IcptwvUZTOOgqniFoTORS7Dbk-o4rE8kYIAaIh03dwFfv-0NLO5o7iVQf9DH9Slcy4OGpWydPpOfLZuC-ZFIH3Wzx82A&dbm_d=AKAmf-CxTYI3GuNQbuhi-Ha6Pudb709-q_-T13wvTuyHaaX3EXi8yFbNt5UnV0v9Ebd3_dD0T2ebVOJtmPQNs7GSo4p65GY2tckogW85f56Wcm8h2PkvhYCkBDkP8gm_McvA_s33aT7djJ71fGu0GMaPLk3DmzlemZSZLdPNT5Utq7N4bJXqGFx0e_TvRulJD3MEjtFzdbSakJrcwUO1oyL-4798-rdmbZAsKfJXK0sH-hHFnB2_q103llsXyr03fn64dsjqGd_wqx_nCriP4T6T0sZhlkxvcEjC8IRMtNcV9ZO-NZgOjiw9nrnXHweW1y_GqqLup9uYCrxlHFa2rLguvQgvGGYsg_EjzFP-OrNIaZL-NyJIZcc2lIvJ2cMTKpP-chGoNdvuUy164vRbjTpzfBBAZAnTYZPqQrsAzt5MI2MoTsoysUTUawlIpJBPFN3pO6gehADgLrbFo6z6PjsOEonh1RiMqOECnJUCQ8Cx_6nyHi0x_4cSGNlt-2611NeLRocIBeOFrmM3MzRWntm4ZgTSbAd4SHVtKKjG4LwzlGWIIfsQugLHOCJIvaWnhmKPixSSqIWtJxvv9HAxYTyvOHNwDJbQzrwF66Gvj1zgqPJd4P28jaAHZgYAlFnxmLO_74IEL0zKLARKmhKpvMvPx6Ag_J5hVFkvqnpaA9vUefmFBH1eC6zlrXVRMcAEahTI88-ipleJGIG0vTWWsEiX7lT4hQt5QFbcl2ACbER2qjwU4Dhl5XJTB7LNp48mOptMpKwJ8cmxwybN48POjjSZSfP_c0xCz5v-3LIz2Qq-R0jNRVLtRxt-ehXiIiZ4IdE_-C23k2YKWfOLaHAdUAIBWqyIHVSlr9-o7qZg7CsoabBb4xXtBYIvRKeZ9XeKueugKVDMESebq0OmY6918MU07kZmWJPWZPuW60STEx8Rl3DopOj-AySIAnJcCZJcaJg5pNzkx5kOk_1wg7lqcAv-vte4e82hb_Erh4V2Fo3097RspRH_QYPTLJ1vmdkUb5Qcl9AaOWYm1my33rguxV4fm-xqfMxJEDzqWi1FYkEcHJg-liPxo3tjbR3XVRsyKa2RypK23vhlqrfBTTDGhc91dZzOI1OolSjWxTaAZrM1xlNEM-AoGDFC2-xQtfR98GUWCvkTnfGrnnQdWm7frChYqys59ciEyDvvhSojLPlk910GzeFzuTWtuGVYBruZyLVNiCPDXP8LWrfXveJWeTlfGRmMJ6rb_wZloMfFKbs9j8ljbZy7mJ0aEpKdrlDBgo2BcECPEa8XNLHK0ntzXK0b8JgQOIawT1u84z9VuW4_RhIOhkanwrK8cO_KHM7H2fuX_cDQzVJ3gu-Am2cu9eGaTcfesMpchuUdy8Ct5jJ8l5gnOd872FvytQa6w_kMHy2iH9IZ9kZu_ZDwwYhxpn71cs5vpI_6IwFVPz28tURXe5n13-v72SZKfZJqfRko7pc9uq5Oj1otui8qN5vyE2fbiPrlPxO1Qt7sy5rT5ixcvxy4lcXxBrD_U7FEDcDrt5EV-TlbwLZpYrs0PXwLTZLNYuN4F7y5tvwz9klQjL0VvLZfIhG8c8JJz-RHO1himqnP3_BgkcCuoxWUAo-nFgof4QasMbI8WteEs7lag2V_yuSPOv4n2ChOCIQn22XqH7iHb1doV8fzTa3k1FDCM4L9XttnH5FSGK-nb6xhkJRn9yX1LrQSZvaJXkVahb6cgnzZG7TvDGQT6q7w2xc3wj-p54lO0lsXihA1mNO8ZhxyBZ_w5WlcRKwgGllglTs_P6uj4U2vsLP2idQznf7Vsci4W_G5kK5QFW2l1kBmkVAP6sU3PE7LQI-IQuLBo5n2lSkXSPkwS7mxJo7Wj3FEzDiIGX4db16PNL08hbGvRtcfH5AFquHW2GSo8kRBW0J9AP-6ng0KuPtHCkNFFWdPkd6RoAx3xu3a6f1OQcjTXoaF9qLFeccJv9Z0QXD7GQOjHELFRJQ2HvE5r9Jq-jzHGVo8y8IHZVfKFP-BayHGxHffkLlTY4AO3nZSKA-yKvzIXJDtQKExGZ_u8dbagn8iXWiqYzeb6fjmMN4YssTxKutt5mty4DjiUXpo6dLQ75XjgZpZJv9pQyD29_H0bZkH9EE5ccGBVnLyTk3IZ4TbZraCny-YR0Eg6dlTM-2lOIH8k38BjNJJMIpyMzayKGiuSaKwEkj4TUbIvetkEB1q95rAcZ9pkZstT5FHNTYW-RwbqgYb_Jyjl6rgbPEwOjm5VHxXbTsaM0UDpY_XljdCCbcPcRGu3mJagtxhvfs9iuBsiSZhplkbgd8hNE0jPiSw8gP1OGlWP715OYgxAOm7vL4XfkPFxusInzTp1TC1lMg_veG2pkoB-LBzUbE2mPwktgD7acyJfAE_D1cTaefoUEgi-XbTble_mIG7KPw3BZOF5fz6JSkzw8WaqvuTNpFdcGb2wA7GMhJ1fEXwJe1Gbj6rhKlmXKU7cjs8YVRejFo2c7yn4dmcF0lzPBz8XSIfKaOrP9LVCSBITK5dW7YhS4WBko79GeZ9l4ub3z-7iexJ23CnavCGCoVie6KMZkfbwiv56tnoMNXIuVjeM_pl4-aTQbsDLtM3WG55e_HzVQdnBavaiUZb00BgL2ZE7tiGLzivhVJjtp3eGQkeCoZNw0AKMVizeSSTFjBBpqpCFz3cE0TQjRVTY73StUTlr9R916DBUcdeJXmLLSkbd1zF1cbh8GwuQr_yU74PKCYQDLTkBp_vE6MvepYTNmEdBz7YxlSH87rKOaj9AIZ7SY0Ql2NsodhnusWXxn4gr4KYXFobulj5qkvQ6oqvoJUI1auoGgz5BTvI4KYwzd4Go05DobfiuDMcloi4eGs6hhrrLzHuSl8aVc42BsbTkHIx_01jOINx3xE5pW83Us_2zsfBwwaU-_JmooHnWZlDxexa10zjsPDNmL0Fj1MQbi64_mfCgKjqFuSVhFrYO8b21cw_i_qv0RdGOEECSxs2ywa-z0mEBjtnVeNGnbyf_sL-is7okWo3IQ1SabRcG7qiUQTfL3shbBusHmH5GeaZKTzPYxKNmhOyL_5fnD7CeASquTCudJl3LHAJ6SiIwUKj2UyjGx1-bjocXimEmyo&cid=CAASFeRoF4JW4g6uqfplRRnnGAjTzYtJ0g&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240
Frame ID: ABED46B55B369F92916EE148456263C5
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNWyccEuIbd5r2LtxvkbCmF8kDhBj0oeq8iop65j330_4UXCQH1NVCJfZfUwsgDxy8HpQCNqxOA612LoSL8GenpO0tgU7f1eEtFCVnj7FWmmA-PI0byJnRKTziVOcnwxElF0NlOgPTYJW53On69XqbEDyqqchPRFdmpgwMtxOztoAG-VBts
Frame ID: A1382379631BE4FFF498653BFB963D71
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DvGlHmrK70D4-qku1VVUXMwzThsAIIagcFELbHhvCCNvVq2fYhXZeYC8E0sdhhKMh-_4VuORKqZoI8YLj8kcVb7dewKtz8X4RTfq-Wa1yDS8iVEy2ikZItAaLK05hwcw-MGcuNp715cjTKEIxDc09RErgHPw&dbm_d=AKAmf-AjUWYQAtkgGT0venmNk1rMbu5-c760SQr81t1_ZGoay46oN5amGPrIGnjHGNbf7iABrTB52QliQ0VUYqrmhdBLOWbauI4dco_7v0mAKJMIqDl0erNQt1E6kq08ncDY6W-v8aRelC_euw5p_eulUt_gHRHdF3YgLMkxFHUrEVmztRTgd434BG7mOGPYfZCz2nFZfaBnPOO4SJWuuyti8To3tXap0Lhjcv1rOybEu-RtGE2hglUfjOkOLrPyMzz3yjqXqCUnP33SzCZeAYvcCkzwhUnn-EHnPkeBhgkEKVMuL3_fJdbHwM8qiyTtRrG9IZroU1l7zTF_djep6vGMOZyFdtrhwOU0EYUPMJe0fWGNdWruEf4U-T3EVzKQidrvme8ysyfi_brRbUpreX9kxDUZJ4M3OhLNefvGXy4-qG1Tq80SxDH8atsNNKfYUvm1ZYU_M_oZ18Jz8qs0BoN-WwW1C6i1evG0SZGbaj1X3GKKBVBiDN1yPGpLJD_J0D_3h2fac5RjE59AnNj4VT0gn7-G5wBlnTltMcdr20zmXCKPUjPdSr3z4EtAscoNYwy1J7Kdb6nbL2VNWTkueYxX_CbNPbDYikY1b9y5bL1w693-n0jup83GbcK1FmWadkUsaXG4USsrnbtO53bpcrYXV4JcleTLWT6qKfUmU2mrIEgHpTgT5_nxlE184SmIV7SXLSM55M-pSX_2pWGmFPHxL___5rL51nVm82iAjOn2vDyBMU1GGn-Sgy8YGNE4PKmf94fyXM0K6FQ7VkYnm9bC-tdasZx6L0G7CairywywDq-pUQe7imHJDVRjsWgeZ65WXe2Td-smzdngvGV3-6pKN2iL1dADWZU7pgW1PKaQPNW3DKmyTzoZs_0v8fMM6HJ0-lLmUbx2Spssqk45ltAZGobjBF6lfFLkgmqVgzYHw558g3LhcnAZkMS7wCTe6JU3S4YBVmt6gpjMihrXTE0dLCD4tjlUhr1uhaq8Kno2avgW_OLbVMqHQdmFtsJIgXqVYDcUdL_XJfHh0dj4EP4dYIO75TnaFeumseiqUmFBCGo8ebI1i6tRb4n79Ay51bTKrouUR3LJjsULHVTt-eTWWBQYkXw0vI7x-3rAPqqn8Ssk4jtyQm9C695V0bNRSztQEHjRNy3xkvNk4yw7pGfFvNcNxYy_JqmSR-S6sJ8TIiXjOxNlOo_kQYCHIWPCEfifmaI9UVA1eYuu-l24gEd6u_HaHke9fDi0BIBiSnsppDp0Bd0n7ZGwO01UMWjVwQomynpbTc77vfdvDbq1vQF7NSNvAzGMso6YhGL7Qnu89rNe4m3vgOOxt29s9cxk4wkIwRMHg19gcJ6mplnDhY-01Y9u78S9N2GugUPerIF7apNPalzhPlTF3NOAg2s5Qy_SoCmkj533L7MC4cIkGoIqGmuee9djC_skozCgpQUM3YzHtHW6fC2WrWYdf6nv_09PYIbPd9YUZiE8iMnmp5VppRO-B_fI7fB2G-bA5XQ2KvZWgSG5hZnW41V9ldePtEI3oRuZc8-qITf6SxwYMbb5sgE6fW9sLyC7DK8Cn48bWtJz8teHt0hl8Ilk3fBonAN8VLDRQhLVa0xVrZoCtPgQP0juKyKJ3sgFB_Sjn_SDbVjUBmSI_wWFzuM_GIbPiUBnmJBA_VMR6t9OZjNCHPNmPlK1eKUivaoxP8m3IEidGBlnPJd87JW-9rNrY_4TPfC2-P1TGUYgsBywpG6keok-CkIPkRpkADVkKgX5dvtBSifZiOqPysZST3Vw8MW44ZbgkvB3-2q5JGm7OjCDpPMDSr_uh_p_wtmF7iWUjmaMfLPkEUICQ76bcYowvuja0wbyBYlO0fkkWmWknb2hu9IRT6fplDFAPj83dWbWAVqXA9-cpiJVNRLFPLE-uSsAPH_AaX6j4b9sSCgcqZ7o25bYkQd8xIK0rP10snYlfyXQmtNK3gkRyQdhI3jezaLOvKOSGgbkjkWgZPMg5gMnpCQUFMV85KHOL6uA-IIFx34dltZG0JLR2wI_mzXqfm-GJKI2k-adETt1GNnRnJZd8LXWtjskDuSOV9ckYtyXFOmtQ2yJZVEv5LURoLkAlwatwKrp66OrC2VS3565rWoshN0fF0MEVUnXtBuKL-dpjv1By9z_X-jFW9aaXfbNCRQGfZv3c5OTXKXACWSJzBOm49f7OkUKDEEd3NV7by1R5w6wQ9_HzjaJjdHOThYFodBz_MLilCIfNpgTyyxknpcG2UhwhoeCd1CAYrj3cc_2kiAUKNzfzduhKgJZ7wQbOTfvpf3AeYHxkeiFC8dR2gsoxnPclXSjOFTHiy1FoJFRwDfO-02tamwmaa7MoAxsiEcP9xyCRHp_-dGYQgojINVrPnHU07nWtTvWQ9v8SpREe2tWZGK99G5VYECBW8qXvsZ_M52hkgNBMlhjaN80_0FTyKPWILWkzAOZssR9ID8MdBSGsTwTDbQd-wNaWlmA0eNMgmSywZhDdTrvgDGf60-MaeHIqAv84l6oPit3_-ss2WgVOeWEIEG3Nt9F1CJUzVVtiMB9I6qM3GDpSAdEbS2LSSN2TrUJel3xiMxW5NQqNQ8CX4LWcBEq07JR9P4DTZfAbzZryPSLH7eMRoOU129wQPNINOkys4dxDXo3gnUteOc7ic5RIm47gON1u5l4BlJc0e8XmxNN4mw88476PexoLgpSLlwuCIFYqqacJ_IQaw1DsKmrlF425rdQ0e8o8r4iYYifgySN7RjvaUh_RsuDvIV97SwcEqNMOj9_YEzhan3eioQb3mC6_3Hfe8N07OpaxwIxJBHV_8nbrYC9c7F-NLw0OERIWr5rl-Hjxfi1k3_HXkIqAf9faW-UR3vdTKpMs7R5U80Blio7-Z2omm8pIMWLWCez5-fxqLfzFsq47exxbEbbLRth_4aPM5Xp4UGKLx_uw-qMdIoHrYIfxU6MgOZRqSZVXQx06yQGuwXG8N_J4zRvNdmMwvbatZ08ydzQ0Vq282N1K_AVAzftUeMIfJHqzSIShj9wA8gtvFUwVCa7AdOKKra7sFb-EdNfWxZ0mcChSXQYPFxGlcIQqyPOdNhgR5UaVrxnps4F-UK56mzIxbm-m3mLRiG_6fygXGKALCbB08ew4rH0&cid=CAASFeRoEGe8K1RQ6TFgzyWuSHnGHaLyfw&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240
Frame ID: 005508D0179FD561F92B20AAC3BFC558
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhjNo5GWATAB&v=APEucNWCa5GaxPdywADoYQXTaFEVy6ogge51CMR9KoyLIedb1hw6T95pmUjHjhflAIwWmEr-GnbTVmpCL12IEAeDHmCoLHaFNAiU5MpMbsqm1BDQXnpBQGdb3kRBwrd80YTYJdzjAQxi8rp_Z7-345BtormKRSVKMGNjljVXmPSpQ9aAQKJZpaM
Frame ID: 086691A72E39A3F99AA1BEF0675448E4
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Frame ID: 1FF9EE0E565FF92E218F6816CD61B40F
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: EF515DD1A00FAEE2744D11E078F49CA8
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 5CDB9E44494FC62F6BEB39DEA323350A
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: F40FC59CAA421EE30AE6D0CDEE6E9CD0
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/8364571/1622764172320/index.html
Frame ID: 28E95203EEBE152AF7585E3D30EB4522
Requests: 19 HTTP requests in this frame

Frame: https://s0.2mdn.net/8364571/1622764172320/index.html
Frame ID: A8C69401EF0D73B678DAB03DD2B4D204
Requests: 19 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 339FA9192C64D512C5744360E5CD7712
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

219
Requests

100 %
HTTPS

53 %
IPv6

22
Domains

41
Subdomains

35
IPs

5
Countries

1827 kB
Transfer

5082 kB
Size

3
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://app.prntscr.com/translate-lightshot.html
Title: Add your language

Search URL Search Domain Scan URL

URL: https://prntscr.com/gallery.html
Title: Sign in

Search URL Search Domain Scan URL

URL: https://twitter.com/Light_shot

Search URL Search Domain Scan URL

URL: http://www.facebook.com/Lighshot

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/
Title: Captured with Lightshot

Search URL Search Domain Scan URL

URL: http://www.google.com/searchbyimage?image_url=https://image.prntscr.com/image/gKdVyS0VTeyIeCZl5_-e-g.png
Title: find similar

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/download.html
Title: Download

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/tutorials.html
Title: Tutorials

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/privacy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/faq.html
Title: FAQ

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/help.html
Title: Help

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/advertise.html
Title: Advertise

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 96

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1

Request Chain 97

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMBtgTgAfR03wETMtUePtgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1

Request Chain 98

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEJuauNZwJeC2shY0CHjw95I&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJuauNZwJeC2shY0CHjw95I%26google_cver%3D1

Request Chain 99

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ0MTE0MjA5NDYzNzg1MTM0NA%3D%3D

Request Chain 100

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1

Request Chain 101

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMBtgTDfB4Kaa6Xm.Kf.ygAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1&google_hm=2

Request Chain 102

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEMamPvdggjJ0s5MHpV8bzs&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1

Request Chain 103

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU1OTQ3MTAzODg4MzEzOTUxNQ%3D%3D

Request Chain 104

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEJkVfqpUj_Gc3imZOuf3ss&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEJkVfqpUj_Gc3imZOuf3ss&google_cver=1&C=1

Request Chain 105

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMBtgTgAfR03wETMtUePtgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1

Request Chain 106

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEMamPvdggjJ0s5MHpV8bzs&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1

Request Chain 107

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA4NTU1MjY1MzQzMzQxMTI4MQ%3D%3D

219 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 14oeka3 Show response
prnt.sc/ 16 KB
5 KB 235ms
137ms Document
text/html 104.26.15.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e19385108eaa0e234eb43abc71de123268178ddd9350b6d9d655695a023935d2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: prnt.sc
:scheme: https
:path: /14oeka3
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
cf-request-id: 0a9144d00700005475f594b000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ivxNZ47SJU46SCY43U1yI8WsXAupImE%2BvWqx89wXzZgVVB5FHTryN0M79%2BTavLgnOG%2BmbhVVlJibGW4SyriswpJ965qU5eZW9VZji07OTYkOr6Ch"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65c8a3f9acd05475-LHR
content-encoding: br

GET
H2 200 main.css
st.prntscr.com/2021/04/08/1538/css/ 57 KB
9 KB 91ms
37ms Stylesheet
text/css 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b67ae2416a166f4238581097d4ce984a69d9662aab12ecc4b2b881c45164e36

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 208
etag: W/"606f23b9-23b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1800
cf-ray: 65c8a3fad90ecd77-CDG
cf-request-id: 0a9144d0ca0000cd77e201f000000001
expires: Wed, 09 Jun 2021 07:53:13 GMT

GET
H2 200 jquery.1.8.2.min.js Show response
st.prntscr.com/2021/04/08/1538/js/ 91 KB
32 KB 121ms
66ms Script
application/javascript 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.1.8.2.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 1488
etag: W/"606f23b9-827c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65c8a3fad90fcd77-CDG
cf-request-id: 0a9144d0ca0000cd7722b8e000000001
expires: Wed, 09 Jun 2021 07:22:02 GMT

GET
H2 200 script.mix.js Show response
st.prntscr.com/2021/04/08/1538/js/ 69 KB
23 KB 94ms
40ms Script
application/javascript 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/script.mix.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45b8a13dcb32541a7703dec7eba4c4195cb62ed00029c2ea5a0b61fd16864b55

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 1488
etag: W/"606f23b9-5e6a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65c8a3fad910cd77-CDG
cf-request-id: 0a9144d0cb0000cd779db68000000001
expires: Wed, 09 Jun 2021 07:24:00 GMT

GET
H2 200 gKdVyS0VTeyIeCZl5_-e-g.png
image.prntscr.com/image/ 89 KB
90 KB 92ms
44ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.prntscr.com/image/gKdVyS0VTeyIeCZl5_-e-g.png
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Magic
Resource Hash: 2e9edf448f9b356fa2fdf3b814de88d006d82b9a9b758a768fddceb7d022bc48

Request headers

Origin: https://prnt.sc
Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 57594
x-powered-by: Magic
content-disposition: inline; filename="gKdVyS0VTeyIeCZl5_-e-g.webp"
content-length: 91504
cf-request-id: 0a9144d1600000edb3bdba2000000001
last-modified: Tue, 08 Jun 2021 08:33:24 GMT
server: cloudflare
etag: "7b40875223ee84d00e9881575a8d2d32"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
access-control-allow-methods: GET, OPTIONS
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-polished: origFmt=png, origSize=165737
accept-ranges: bytes
cf-ray: 65c8a3fbca7fedb3-CDG
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
cf-bgj: imgq:100,h2pri

GET
H2 200 14oeka3
prnt.sc/ 16 KB
16 KB 129ms
127ms Image
text/html 104.26.15.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prnt.sc/14oeka3

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /14oeka3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: prnt.sc
referer: https://prnt.sc/14oeka3
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://prnt.sc/14oeka3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VH7gKQAvYSw1qfdslRvnYUD7wD989FB2yt7OByFjAnCafCffyg109kH%2B7iPco%2FOV2MHH3GlUu2XkF%2FjiniMRCf5CLnNg%2BHyYB6LMGUsvNVgFITtE"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 65c8a3fb780a5475-LHR
cf-request-id: 0a9144d12f00005475ea1a3000000001

GET
H2 200 image-helper.js Show response
st.prntscr.com/2021/04/08/1538/js/ 3 KB
1 KB 35ms
34ms Script
application/javascript 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/image-helper.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83817752fb260ff66b3bca1471bb20dbb6a1e6a17174c657efe0912ad161b382

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:07 GMT
server: cloudflare
age: 208
etag: W/"606f239b-a2f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65c8a3fb49a4cd77-CDG
cf-request-id: 0a9144d10e0000cd77cc302000000001
expires: Wed, 09 Jun 2021 07:25:13 GMT

GET
H2 200 footer-logo.png
st.prntscr.com/2021/04/08/1538/img/ 630 B
833 B 38ms
36ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/footer-logo.png
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bca2c1abcf4b76a46306bc7f1a607a459371ccf5e7213aae988c33b4dabb1758

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 1745
cf-polished: origFmt=png, origSize=1848
content-disposition: inline; filename="footer-logo.webp"
content-length: 630
cf-request-id: 0a9144d12e0000cd77b534f000000001
last-modified: Mon, 05 Sep 2016 15:49:19 GMT
server: cloudflare
etag: "57cd93ff-738"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:27:34 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fb7a00cd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 jquery.smartbanner.css
st.prntscr.com/2021/04/08/1538/css/ 4 KB
1 KB 32ms
31ms Stylesheet
text/css 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/css/jquery.smartbanner.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d91d13fd8f9d253a8213aeee7ebaa7e073683fc600a3d82902c3c669b8ffdee7

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:31 GMT
server: cloudflare
age: 208
etag: W/"606f23b3-ef0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1800
cf-ray: 65c8a3fb69cccd77-CDG
cf-request-id: 0a9144d1200000cd7706250000000001
expires: Wed, 09 Jun 2021 07:24:39 GMT

GET
H2 200 jquery.smartbanner.js Show response
st.prntscr.com/2021/04/08/1538/js/ 8 KB
3 KB 38ms
36ms Script
application/javascript 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.smartbanner.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b185d89e437f1591af8c51d5e6dad41d3666e22a81931ee9df22e2cfdacaddb

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 1488
etag: W/"606f23b9-aec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65c8a3fb79fdcd77-CDG
cf-request-id: 0a9144d12e0000cd77c33a6000000001
expires: Wed, 09 Jun 2021 07:24:57 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 6547
date: Wed, 09 Jun 2021 05:38:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Wed, 09 Jun 2021 07:38:52 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/ 3 KB
2 KB 69ms
22ms Script
application/javascript 2600:9000:218c:f800:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:f800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 09 Jun 2021 07:27:36 GMT
content-encoding: br
last-modified: Wed, 10 Feb 2021 21:13:06 GMT
server: AmazonS3
age: 29
etag: W/"9074c1a966aada274b63c92859c4a3ec"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 3297a5976e2bfe60c9503c52ec1561a0.cloudfront.net (CloudFront)
cache-control: max-age=900
cross-origin-resource-policy: cross-origin
x-amz-cf-pop: CDG50-P1
x-amz-cf-id: lYK1_djdCud_AnLnlcV_DQvFt-nYUKOOvyCDZiJBHegt6tlnNFEEvg==

GET
H2 200 page-bg.png
st.prntscr.com/2021/04/08/1538/img/ 5 KB
6 KB 34ms
34ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/page-bg.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86a1b8f94f48c4e82d2616d4c581f10a34ff447a2bd95be08714fa0d19ba3f51

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=7116
content-disposition: inline; filename="page-bg.webp"
content-length: 5608
cf-request-id: 0a9144d12e0000cd77e33a8000000001
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
etag: "606f23b9-1a7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:53:34 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fb7a01cd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 header-logo.png
st.prntscr.com/2021/04/08/1538/img/ 4 KB
4 KB 35ms
35ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/header-logo.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40ec0b04019845302a5052b4689b5d3477c9717dca73243e5faf7cf98f3af564

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=7995
content-disposition: inline; filename="header-logo.webp"
content-length: 4148
cf-request-id: 0a9144d12f0000cd77242f6000000001
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
etag: "606f23b9-1e52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:44:24 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fb7a04cd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 button-download.png
st.prntscr.com/2021/04/08/1538/img/ 314 B
636 B 35ms
33ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/button-download.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e926f30958d0c21d088e6a671d3356a3c3fab9cc6220b8e408f19d868a7dc5c8

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 1456
cf-polished: origFmt=png, origSize=1404
content-disposition: inline; filename="button-download.webp"
content-length: 314
cf-request-id: 0a9144d1320000cd77b294f000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-57c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:29:42 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fb8a0acd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 button-icon-sep.png
st.prntscr.com/2021/04/08/1538/img/ 40 B
226 B 36ms
35ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/button-icon-sep.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6a1120cc303b1c6ee6d548a5b418c2707b59de0c1f13c8ab870ca4e734b6acc

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=928
content-disposition: inline; filename="button-icon-sep.webp"
content-length: 40
cf-request-id: 0a9144d1330000cd77ba0f9000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-3a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:44:58 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fb8a0ccd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-twitter_gscale.png
st.prntscr.com/2021/04/08/1538/img/ 374 B
556 B 36ms
35ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-twitter_gscale.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a3a63b2ac124cb9a194ec01ea1f0d3123e4019bf658c6f47a77b4faea84c079

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 1745
cf-polished: origFmt=png, origSize=1535
content-disposition: inline; filename="icon-twitter_gscale.webp"
content-length: 374
cf-request-id: 0a9144d1330000cd77952e1000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-5ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:24:43 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fb8a0ecd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-facebook_gscale.png
st.prntscr.com/2021/04/08/1538/img/ 296 B
476 B 39ms
39ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-facebook_gscale.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a093d2047e1a59b7103810b947780e5f94d865915cb923ebcaa7e50f557c2102

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=1325
content-disposition: inline; filename="icon-facebook_gscale.webp"
content-length: 296
cf-request-id: 0a9144d1360000cd77bcb9b000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-52d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:54:48 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fb8a10cd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 async-ajs.min.js Show response
cdn.ad4game.com/ 3 KB
2 KB 83ms
21ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/async-ajs.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Thu, 15 Apr 2021 06:26:15 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: W/"6077dc87-ca8"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes
content-length: 1451

GET
H2 200 icon-edit.png
st.prntscr.com/2021/04/08/1538/img/ 214 B
391 B 83ms
83ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-edit.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb09c3720b53d8651d6f5825cf643e6249aefbe82a1ba1417d230cdb9b36cba6

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 1745
cf-polished: origFmt=png, origSize=3153
content-disposition: inline; filename="icon-edit.webp"
content-length: 214
cf-request-id: 0a9144d16a0000cd77d9a34000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-c51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:26:27 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fbda8fcd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-camera.png
st.prntscr.com/2021/04/08/1538/img/ 158 B
369 B 44ms
44ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-camera.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bfd2fa3b3b5924e3655bcf9f63427e792bd8572b7ed0992373bdb4b21c7cb89

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 1745
cf-polished: origFmt=png, origSize=1089
content-disposition: inline; filename="icon-camera.webp"
content-length: 158
cf-request-id: 0a9144d16a0000cd77f5073000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:02:46 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fbda91cd77-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-abuse.png
st.prntscr.com/2021/04/08/1538/img/ 126 B
303 B 53ms
53ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-abuse.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2875a6fc4266fec00a383377cb4530b6407912897b0727e26249d89c6dfe0359

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=327
content-disposition: inline; filename="icon-abuse.webp"
content-length: 126
cf-request-id: 0a9144d16a0000cd77c0b78000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-147"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 07:47:06 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65c8a3fbda93cd77-CDG
cf-bgj: imgq:100,h2pri

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 28ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=57094415&t=pageview&_s=1&dl=https%3A%2F%2Fprnt.sc%2F14oeka3&ul=en-us&de=UTF-8&dt=Screenshot%20by%20Lightshot&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=2123593173&gjid=1364548953&cid=504293180.1623223679&tid=UA-12353127-1&_gid=449960298.1623223679&_r=1&_slc=1&z=1135875346

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:27:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
api.prntscr.com/v1/ Frame 0
0 137ms
128ms Preflight 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.prntscr.com/v1/
Protocol: H2
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://prnt.sc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-request-id: 0a9144d1750000edb3a02c5000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 65c8a3fbead5edb3-CDG

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
3 KB 22ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

571c6ede630ca7f890f557ceff9b88fb2e212f9fc28cde4a460bd097c3f1a5df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: kBlDgG3gCxW6h17/Q5cHTw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1779
x-fb-rlafr: 0
x-fb-debug: 5XF3PfJ9ypMUoiExKMLwGToeMSJMUFHhpFSi9nGA4salX6DHv2QZus31FY3TZaJL9Yme9qNy1zCGLwe83+KH7g==
x-fb-trip-id: 686109401
x-fb-content-md5: 33b422be87dd14217790a8a91443477c
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 09 Jun 2021 07:27:59 GMT
vary: Accept-Encoding
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "a2d3c014c95e6c017c8a23dfee545def"
timing-allow-origin: *
priority: u=3,i
expires: Wed, 09 Jun 2021 07:43:00 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 40ms
13ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6772) /
Resource Hash: a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 09 Jun 2021 07:27:59 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Apr 2021 17:57:32 GMT
Server: ECS (frb/6772)
Age: 1210
Etag: "9eb59e5602fef4b3ebf6090856ff21db+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 28779

POST
H2 200 / Show response
api.prntscr.com/v1/ 92 B
316 B 126ms
125ms XHR
application/json 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.prntscr.com/v1/
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.1.8.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c9935e1daafc929a9866a206e769e084cd83f19d436ca22887adc2798408646

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
cf-ray: 65c8a3fcbbd3cd77-CDG
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-request-id: 0a9144d1f70000cd77bcba6000000001

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 27ms
8ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Wed, 16 Jun 2021 07:27:59 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 234 KB
59 KB 27ms
26ms Script
text/javascript 2600:9000:218c:f800:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:f800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2ddef05ee7b0caa6fd9be281a5b4e53ada42bff7814578d748144f2f9181e476

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: br
x-amz-cf-pop: CDG50-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Thu, 13 May 2021 19:03:54 GMT
server: AmazonS3
etag: W/"2848b39634e3b71d7b4f01531f83807a"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 3297a5976e2bfe60c9503c52ec1561a0.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
x-amz-cf-id: XVr46p7A-BkupgkOb_vmp7yrJ5SV0JNXulQFvE0OOUDSdFM-NrwwCQ==

GET
H3-29 200 all.js Show response
connect.facebook.net/en_US/ 221 KB
65 KB 13ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=8420eac33679dee21c0eb63b77631717&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a08178bec59e311f41fce9704d72ad4e969afb4221d8072115fd6ca8fc4ab57b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://prnt.sc
Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: gpw1MA5UwOFE2O2A83SqOA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 66277
x-fb-rlafr: 0
x-fb-debug: 2Q/yNb2BHk202+fxg5jBG9KzuzO8LdgSUIhGqR1g1TJya4q2XeBYDADMzPh9Eo1eHGD5k2jxHbCvuv00gZUezg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: f442c3be8d70800ea220361f0a2e6315
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 09 Jun 2021 07:27:59 GMT
vary: Accept-Encoding
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "0885eb80b146e9ee46903affbb6193a2"
timing-allow-origin: *
priority: u=3,i
expires: Thu, 09 Jun 2022 03:28:42 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
440 B 41ms
15ms XHR
text/plain 2a00:1450:400c:c0a::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-12353127-1&cid=504293180.1623223679&jid=2123593173&gjid=1364548953&_gid=449960298.1623223679&_u=IEBAAEAAAAAAAC~&z=511764066

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0a::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 09 Jun 2021 07:27:59 GMT
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-n-ZGqfdsg5894.js Show response
rules.quantcount.com/ 2 B
345 B 29ms
7ms Script
application/javascript 2600:9000:211e:bc00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-n-ZGqfdsg5894.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:bc00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:08:13 GMT
via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
server: AmazonS3
age: 1186
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-C2
content-length: 2
x-amz-cf-id: a6uvZDm2eIuJJreAuiNZzAnrlz2l5dPKc1J6pIYXLnQGniPFAQIRvg==

GET
H/1.1 200
OK widget_iframe.06c6ee58c3810956b7509218508c7b56.html Show response
platform.twitter.com/widgets/ Frame 652E 319 KB
103 KB 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fprnt.sc
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674C) /
Resource Hash: 5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 473995
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 09 Jun 2021 07:27:59 GMT
Etag: "dab7ee9ff99366614e06e117bab5e542+gzip"
Last-Modified: Wed, 28 Apr 2021 17:56:54 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/674C)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105298

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
293 B 17ms
16ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-12353127-1&cid=504293180.1623223679&jid=2123593173&_u=IEBAAEAAAAAAAC~&z=688851917

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:27:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 38ms
17ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-12353127-1&cid=504293180.1623223679&jid=2123593173&_u=IEBAAEAAAAAAAC~&z=688851917

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:27:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 43ms
29ms Fetch
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=154822244543652&input_token&origin=1&redirect_uri=https%3A%2F%2Fprnt.sc%2F14oeka3&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=8420eac33679dee21c0eb63b77631717&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: EyvpNpYcKDEFQzbjThOlAJOf3cnSCeLt29P4LgPrfnq2WEZtzyowmcR4cGlYJA4elTysSBsT4pU3ow1TS48LWw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 09 Jun 2021 07:27:59 GMT
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 prebid.js Show response
cdn.ad4game.com/ 261 KB
98 KB 34ms
34ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/prebid.js
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 733f44e4d42f00e0a8c267d516e9f6939d36f65ceb3bf851998475b9f6650d3f

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Fri, 28 May 2021 08:02:31 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: W/"60b0a397-412ac"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes
content-length: 99905

GET
H/1.1 200
OK async-ajs.php Show response
ads.ad4game.com/www/delivery/ 9 KB
3 KB 488ms
126ms Script
text/javascript 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g6406992&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F14oeka3&c=UTF-8&z=60918,70076,60916&b=7&x=7
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: adf22c5d5e4b62ff7aec8635fa489d8fa664e2c261f14ae89ea43af3d38db622

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-servername: ads.ad4game.com\ 80\ 81
Pragma: no-cache
Date: Wed, 09 Jun 2021 07:27:59 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="CUR ADM OUR NOR STA NID"
X-serveraddr: 10.100.0.151
Cache-Control: no-cache, no-store, must-revalidate
X-host: ads.ad4game.com
Connection: close
Content-Type: text/javascript; charset=UTF-8
Expires: 0

GET
H2 200 pixel;r=1529694118;source=choice;rf=0;a=p-n-ZGqfdsg5894;url=https%3A%2F%2Fprnt.sc%2F14oeka3;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=1;gdpr_consent=;ref=;d=prnt.sc;je=0;sr=160...
pixel.quantcount.com/ 35 B
210 B 9ms
8ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantcount.com/pixel;r=1529694118;source=choice;rf=0;a=p-n-ZGqfdsg5894;url=https%3A%2F%2Fprnt.sc%2F14oeka3;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=1;gdpr_consent=;ref=;d=prnt.sc;je=0;sr=1600x1200x24;dst=1;et=1623223679431;tzo=-120;ogl=site_name.Lightshot%2Ctitle.Screenshot%2Cimage.https%3A%2F%2Fimage%252Eprntscr%252Ecom%2Fimage%2FgKdVyS0VTeyIeCZl5_-e-g%252Epng%2Cdescription.Captured%20with%20Lightshot%2Curl.https%3A%2F%2Fprnt%252Esc%2F14oeka3%2Ctype.website

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:27:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 652E 256 B
442 B 198ms
136ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=06bf6e7a32ff92d31ef5ec12eb3b308f51d52f06

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fprnt.sc

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 07:27:59 GMT
server: tsa_f
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: ebdc7aee3a4a0ce7d145c69b489b3e492ff067bada387ba34361572a505726fd
content-length: 176

GET
DATA 200
OK truncated
/ 167 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e4822754298eb051c68617cbfaa42f2ed7933919c3c8ef569ed5da3e75dc4d6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK button.5573c974dc31bbdab5ea7923a0bd5cf3.js Show response
platform.twitter.com/js/ 7 KB
3 KB 6ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.5573c974dc31bbdab5ea7923a0bd5cf3.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6772) /
Resource Hash: e05edf2ae58e3a9f1d2a84d32a8b216fd0aece46f527b58dcbce75255989ea88

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 09 Jun 2021 07:27:59 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Apr 2021 17:56:41 GMT
Server: ECS (frb/6772)
Age: 473996
Etag: "382be2960021b88f6ce982d997cdbd01+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2294

GET
H/1.1 200
OK tweet_button.06c6ee58c3810956b7509218508c7b56.en.html Show response
platform.twitter.com/widgets/ Frame 0A5A 32 KB
12 KB 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.06c6ee58c3810956b7509218508c7b56.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6772) /
Resource Hash: 483cc9a5ece5c92d5a2f1ea6e92e7f8bc29844a6c06bf36c0349d70334685dc7

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 473996
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 09 Jun 2021 07:27:59 GMT
Etag: "a87932e0f094e1fb4cced05f7d97ab94+gzip"
Last-Modified: Wed, 28 Apr 2021 17:56:47 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6772)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 12228

GET
DATA 200
OK truncated
/ Frame 0A5A 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
329 B 137ms
136ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fprnt.sc%2F14oeka3%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22light_shot%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1623223679803%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%2282e1070%3A1619632193066%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 09 Jun 2021 07:27:59 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: ebdc7aee3a4a0ce7d145c69b489b3e492ff067bada387ba34361572a505726fd
x-transaction: 7e490ba0b7558752
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 61 KB
21 KB 35ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g6406992&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F14oeka3&c=UTF-8&z=60918,70076,60916&b=7&x=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a9731d5f0175ea3f2b19c6344695ee21a2a7e5462ecb0f1da4ef9b47e5c9873

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "897 / 937 of 1000 / last-modified: 1623190301"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21289
x-xss-protection: 0
expires: Wed, 09 Jun 2021 07:27:59 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 123 KB
33 KB 102ms
57ms Script
application/javascript 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g6406992&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F14oeka3&c=UTF-8&z=60918,70076,60916&b=7&x=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: Server /
Resource Hash: 5b6f3806c04b7c91d2ee5cf8f42b31343a9d33ea62ad9d0506cfa1be078477d3

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:27:20 GMT
content-encoding: gzip
server: Server
age: 39
etag: 6bda376aea84df42909484ff0d20f22a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 23ce0cf88557469ee496b72a281aec5c.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: CDG50-P2
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: E3YSXBJMjZlokKHa7.qL9ZqkRLiXb9jY
x-amz-cf-id: 5RvGlkKfUJEO8EuDHFQ1c9y2Je8roCB4fkc2qAAC6M87WYgsZwd8wg==

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 24 B
367 B 210ms
134ms XHR
application/json 2.21.111.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=619471&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%221fa5ee6bf9dbb5%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fprnt.sc%2F14oeka3%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A3%2C%22ren%22%3Afalse%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22indexexchange.com%22%2C%22sid%22%3A%22193578%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%222dc2bfc719be65%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22331d2282f4e43d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22494ac9ef2aa78b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22610018%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.111.28 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-111-28.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1cabd52f434f5c55be949d18a9e443febf2a04296caa511e2c7f4a1693fbbd78

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[FR], RC:[IDF], CN:[EU], CIP:[82.102.18.235], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://prnt.sc
x-cs-client-geo: 28
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
x-ak-client-geo: 28
expires: Wed, 09 Jun 2021 07:28:00 GMT

GET
H/1.1 200
OK bid Show response
ads.ad4game.com/v1/ 5 KB
2 KB 562ms
331ms XHR
application/json 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/v1/bid?if=0&siteurl=https%3A%2F%2Fprnt.sc%2F14oeka3&size=970x90%3B970x90%3B300x250&id=6fed29058bab87%3B7a5f5103a09cfc%3B85b518200ec5fb&zoneId=60918%3B70076%3B60916&gdpr=%5Bobject%20Object%5D
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: 88e2b2882d0550a9dad1d3044abc2153c3e2c9df38381076e3190909f77e05c9

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Jun 2021 07:28:00 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://prnt.sc
Transfer-Encoding: chunked
Connection: close
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
X-Application-Context: application:12061

GET
H2 200 pubads_impl_2021060301.js Show response
securepubads.g.doubleclick.net/gpt/ 312 KB
110 KB 109ms
37ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

sffe /

Resource Hash

d0b3850a417ef733c6acaff02a3311c7ce9a5b7ee55d2cd76d8c7f1f661bcb20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 08:37:25 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112073
x-xss-protection: 0
expires: Wed, 09 Jun 2021 07:28:00 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
304 B 21ms
21ms XHR
text/plain 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=852e3ca3-c387-44e4-a5c1-67c46495a8c4&u=https%3A%2F%2Fprnt.sc%2F14oeka3
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 03:36:21 GMT
via: 1.1 23ce0cf88557469ee496b72a281aec5c.cloudfront.net (CloudFront)
server: Server
age: 13899
x-cache: Hit from cloudfront
access-control-allow-origin: https://prnt.sc
cache-control: max-age=86087, s-maxage=86400
access-control-allow-credentials: true
x-amz-cf-pop: CDG50-P2
x-amz-cf-id: wmkorUvbeeBHYEQ23w7b-U-qSDzR-G_6RGrcE3EzNQjeedx2SdfvHw==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
364 B 48ms
48ms XHR
text/javascript 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fprnt.sc%2F14oeka3&pid=GX497BhYq9avh&cb=0&ws=1600x1200&v=7.65.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F60918%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F70076%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F60257202%2F60916%22%7D%5D&cfgv=0&pubid=852e3ca3-c387-44e4-a5c1-67c46495a8c4&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
via: 1.1 23ce0cf88557469ee496b72a281aec5c.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CDG50-P2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 39VDIHrHDSbxTJ8zMhSQuTHkJsuLkeO40Es92B0aKL7RzoJdfvMrKg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 62ms
21ms XHR
application/javascript 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: eEYYOb32LZFr6yGAi8hXG4401uAIPew2
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 71323
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 05:49:36 GMT
server: AmazonS3
date: Tue, 08 Jun 2021 11:39:18 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 e832b62df62ac7dea0463212e63d91f7.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: CDG50-P2
x-amz-cf-id: ePWceRzVh5x0TPSdyBZCxJ0pb2an4Za4_kRJnDdAwpSziZXsTfccZA==

GET
H3-29 200 like.php
www.facebook.com/plugins/ Frame 3840 0
0 32ms
25ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df258453ed8dc7ec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2F14oeka3&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=8420eac33679dee21c0eb63b77631717&ua=modern_es6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df258453ed8dc7ec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2F14oeka3&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-xss-protection: 0
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
content-type: text/html;charset=utf-8
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
x-fb-debug: o5ZTTRqRCigqgjVTDhLWzn4C9Cl4lDVKtwc0wM2AK+RDn432Q7x2UmP9Zrg/4UEC3Px/vGSsE4VsxgQdsRsWWQ==
content-length: 0
date: Wed, 09 Jun 2021 07:28:00 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H3-29 200 comments.php
www.facebook.com/plugins/ Frame F8DF 0
0 28ms
23ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df107455086d6f38%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2F14oeka3&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=14oeka3

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=8420eac33679dee21c0eb63b77631717&ua=modern_es6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df107455086d6f38%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2F14oeka3&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=14oeka3
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-xss-protection: 0
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
content-type: text/html;charset=utf-8
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
x-fb-debug: NGR4trOEXhHu7VMZzrH+l540dPN0yj7iUPmo+fWCtQKORCqcWAnh5mixVuDZsF9Yn1DSxilN+iqMH22ouHCfoQ==
content-length: 0
date: Wed, 09 Jun 2021 07:28:00 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H3-29 200 like_box.php Show response
www.facebook.com/plugins/ Frame ED15 50 KB
15 KB 69ms
66ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1177771c9530a8%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=8420eac33679dee21c0eb63b77631717&ua=modern_es6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a841d7afa97a0ba1207b5c0e638104067247b17a9ced39b3d283511a4f5c92d1

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1177771c9530a8%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
x-xss-protection: 0
content-encoding: br
x-content-type-options: nosniff
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}
strict-transport-security: max-age=15552000; preload
expires: Sat, 01 Jan 2000 00:00:00 GMT
vary: Accept-Encoding
pragma: no-cache
x-fb-rlafr: 0
content-type: text/html; charset="utf-8"
x-fb-debug: +icSPdl/HDFR8p/8zDnPijtNNX/+Ezn7meSy94hgYE5cNnaFxMJNKDKOd2tYbTn22+LgJLimhemTV6gKHkdPSQ==
date: Wed, 09 Jun 2021 07:28:00 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 AD5a2s9MmAB.css
static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/ Frame ED15 17 KB
5 KB 22ms
6ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/AD5a2s9MmAB.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1177771c9530a8%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

33c4d08388d6d96ef7d9686c87b96813db25b70791ae1fc620e7120f49d0aec3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: vsKt8TNfQZXx6KsBJlSTJA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4595
x-fb-rlafr: 0
x-fb-debug: bubYRkIlbX81o/fiLYCGiN9eQ5r6cLZNJ2+eizhR907Fmta9QSW+v2DOHAxziedooOWTyrKCDZopsrEl0snBRw==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 08 Jun 2022 22:55:18 GMT

GET
H2 200 ggzcJLJkhSr.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ Frame ED15 3 KB
1 KB 23ms
7ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ggzcJLJkhSr.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b3408a1b744ce1351e9554b861c45480f39e54c059f3b11f4e77f9f13564ba4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: ywe+5CCuBA6nTAXpv0OCFQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1102
x-fb-rlafr: 0
x-fb-debug: nl9zIMcqcteQnWOm3cQ7sSvnzT4T1EQ/zh1xCxE2tQPuCP1E32IlNYiD3mVPuxJmOolNmtWLYkElguw+6F0D+w==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 26 May 2022 21:31:49 GMT

GET
H2 200 jQe3NSGojaA.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yD/r/ Frame ED15 293 KB
80 KB 23ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/jQe3NSGojaA.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

eb1c22262cae591f58b1b4473386fe51c67ca0094d38a180dd86224a4b6d074c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: Ma9ekDxVAUzW9iJ4XwSRlg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 81705
x-fb-rlafr: 0
x-fb-debug: Nrn45eJeKWFiePqc25VFqQ+LEYpZxN0h9MsUUUuzJtNk5uTjgRPDeN9S5IIs3omxCOAMEiJcLyPuq3olWTOqlQ==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 07 Jun 2022 23:17:03 GMT

GET
H2 200 GG1Y0sYc7My.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yv/r/ Frame ED15 5 KB
2 KB 23ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/GG1Y0sYc7My.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

39685db80e880ec9e59c22115c5bcbf76586a95bf618a714d61fc0e5f271fe77

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: kw22OIA6eDgOltzbJdNVmQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1640
x-fb-rlafr: 0
x-fb-debug: Zmpw3RhSUxiv3ALyOl/X4gQUGWydoMuoaqLd52UaqZXY77+VTAD/vsrveOiXvtJleRM4HwyKnTfMFQrLDgIy9Q==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 02 Jun 2022 17:51:54 GMT

GET
H2 200 SO5MZebhBBA.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yk/r/ Frame ED15 65 KB
20 KB 29ms
14ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yk/r/SO5MZebhBBA.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4974d6b29a9ffda5bdc00cadd30ce8a64b9fb8a33af884cc9006f88f0f23b02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: Ej2uzP84t/wcyULkf/6MKA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 20329
x-fb-rlafr: 0
x-fb-debug: 0E0wTlu86QzJIa57SJk8GmR9U63nmir2lm6u8DN2zZQFGTZzV7GZEB4z4A158yQzW+1JY9n0cJoQ5/pX1mH/CQ==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 04 Jun 2022 23:10:18 GMT

GET
H2 200 6H8tZshKWoP.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yd/l/en_US/ Frame ED15 126 KB
35 KB 29ms
14ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yd/l/en_US/6H8tZshKWoP.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4d7c4940621049c43edcc6e709582f94de87f1d11a79df960efedd683e780769

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: VK45W0Ed5i2K3bLr+X+mmA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 35943
x-fb-rlafr: 0
x-fb-debug: yqhVD585OOQhm4i5zDYBn23h4TQXJYTKEN/gf9D/FLi7wdOMMF58uhnwAcTFv5B+qsDK7plH/rXGDjKaWmIXsg==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 08 Jun 2022 22:57:20 GMT

GET
H2 200 10380207_10152455232975761_8123100998967752904_o.png
scontent-frt3-2.xx.fbcdn.net/v/t31.18172-0/p130x130/ Frame ED15 36 KB
36 KB 9ms
6ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frt3-2.xx.fbcdn.net/v/t31.18172-0/p130x130/10380207_10152455232975761_8123100998967752904_o.png?_nc_cat=1&ccb=1-3&_nc_sid=dd9801&_nc_ohc=j7Rq1o9V6B4AX_hmVTM&_nc_ht=scontent-frt3-2.xx&tp=30&oh=5d0e3b23396bcf842b31cb354c895538&oe=60E4ABE4
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1177771c9530a8%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 7f0c0d5e15ee4b3a06964f2256fc37be30934a62b0e0bf61a00eb0aa47969eb6

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 591433749
date: Wed, 09 Jun 2021 07:28:00 GMT
x-fb-trip-id: 686109401
last-modified: Thu, 22 May 2014 08:24:07 GMT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1994070467
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 37042

GET
H2 200 277895_10151200062570761_1904128644_o.jpg
scontent-frt3-2.xx.fbcdn.net/v/t31.18172-1/cp0/p50x50/ Frame ED15 1 KB
1 KB 6ms
6ms Image
image/jpeg 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frt3-2.xx.fbcdn.net/v/t31.18172-1/cp0/p50x50/277895_10151200062570761_1904128644_o.jpg?_nc_cat=1&ccb=1-3&_nc_sid=dbb9e7&_nc_ohc=1uUmTXLoSlgAX-Lfo-j&_nc_ht=scontent-frt3-2.xx&tp=27&oh=bb1f124d57837385acd6210c79a3a1a4&oe=60E733AD
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1177771c9530a8%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff21d99a59d57bb%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: fe0b009af4d6be99bb24436d2b2c67706fa3698e059d8df3bfa9f9c8857b42ae

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 3015587832
date: Wed, 09 Jun 2021 07:28:00 GMT
x-fb-trip-id: 686109401
last-modified: Wed, 22 Aug 2012 00:00:00 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1162695912
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1288

GET
H3-29 200 ApcBOUT5FoS.png
static.xx.fbcdn.net/rsrc.php/v3/y_/r/ Frame ED15 573 B
624 B 13ms
6ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y_/r/ApcBOUT5FoS.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/AD5a2s9MmAB.css?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

641e03dfeee60c05e0794bace5fc58d2fba409fee529a114459e44cee0d9d069

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/AD5a2s9MmAB.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: w/fMw0DrZxMGtf9Rccu7AJFTGyVkaSrXrJYBtFb9Rae0RW9TqOQo46iFEoGQpGDqHpN1xqeFzUfMy6Ol1QGAYg==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: Y/eW3MWFNJnkcpEqoXzG3Q==
date: Wed, 09 Jun 2021 07:28:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 573
x-fb-rlafr: 0
expires: Sat, 28 May 2022 23:34:54 GMT

GET
H3-29 200 UC8EZkcaw4t.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yf/r/ Frame ED15 7 KB
2 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yf/r/UC8EZkcaw4t.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/jQe3NSGojaA.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

77255842cd0198cc930adf101a6a6388687ad459659b03a1515c0478cfed7f9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: PmlokjsUBsgw0yJXA5kwYA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2247
x-fb-rlafr: 0
x-fb-debug: NrRYd6QLBpHPQ25sgtQ9ZPgMusW/Yj3+jUT+kSPEh/8SiBf5CFadzpHlZ7iDwRfT2y0Toku7yF0q17rLOSo3pA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 04 Jun 2022 18:32:06 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 36ms
15ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 35ms
14ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 07:28:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
16 KB 981ms
944ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2312351139813102&correlator=1063089814795441&output=ldjh&impl=fifs&eid=31060789%2C31061224%2C31061358&vrg=2021060301&ptt=17&gdpr=1&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210609&iu_parts=60257202%2C60918%2C70076%2C60916&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=970x90%2C970x90%2C300x250&prev_scp=amznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D970x90%26hb_pb_a4g%3D0.04%26hb_adid_a4g%3D6fed29058bab87%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D970x90%26hb_pb%3D0.04%26hb_adid%3D6fed29058bab87%26hb_bidder%3Da4g%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D300x250%26hb_pb_a4g%3D0.01%26hb_adid_a4g%3D85b518200ec5fb%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D300x250%26hb_pb%3D0.01%26hb_adid%3D85b518200ec5fb%26hb_bidder%3Da4g&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1623223680&dt=1623223680520&dlt=1623223679113&idt=1039&frm=20&biw=1600&bih=1200&oid=3&adxs=315%2C315%2C315&adys=70%2C1088%2C1210&adks=1432691387%2C3120184932%2C4042975291&ucis=1%7C2%7C3&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fprnt.sc%2F14oeka3&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x90%7C970x90%7C300x250&msz=970x-1%7C970x-1%7C300x-1&ga_vid=504293180.1623223679&ga_sid=1623223681&ga_hid=57094415&ga_fc=false&fws=0%2C0%2C0&ohw=0%2C0%2C0&btvi=0%7C0%7C1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

3b7f5d160b2635aee3f9b25f405468591bb6030ea06833d1a6f0903d3d921d51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16483
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 48ms
14ms Other
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 container.html Show response
d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F72B 6 KB
3 KB 21ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 09 Jun 2021 07:28:00 GMT
expires: Thu, 09 Jun 2022 07:28:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4F63 6 KB
3 KB 18ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 09 Jun 2021 07:28:00 GMT
expires: Thu, 09 Jun 2022 07:28:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d8c7ce12428be733a9213b2fecae66db6950a933c276d68bf7c8271829a627d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066164336645"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28149
x-xss-protection: 0
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H3-29 200 container.html Show response
d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CA86 6 KB
3 KB 10ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 09 Jun 2021 07:28:00 GMT
expires: Thu, 09 Jun 2022 07:28:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 40ms
18ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021060301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f252f831348291683eba4029829349268decef978095402981152829a189ec9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7936
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CBEC 624 B
559 B 47ms
20ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNW5_6Pl30gciA8YvnfC8Y8S4LVKJkagoXAEm6reB1W5akIjPeMhHBeAZ_iRjOkvYqzUmGXtnB52D7rzeBdsz2wUfR5N7tzcyEJexmejGh5qOaATx_MU2Gbe2WHM04JTMvh4QCuGnk3QsLq9fmFsOtdGRmkpBr5-v0Nw3f4dO1agbSBDiik

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNW5_6Pl30gciA8YvnfC8Y8S4LVKJkagoXAEm6reB1W5akIjPeMhHBeAZ_iRjOkvYqzUmGXtnB52D7rzeBdsz2wUfR5N7tzcyEJexmejGh5qOaATx_MU2Gbe2WHM04JTMvh4QCuGnk3QsLq9fmFsOtdGRmkpBr5-v0Nw3f4dO1agbSBDiik
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Jun 2021 07:28:01 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlCXQBrFyPLJbG5qI3eoNf93BqT66qbQ8HNeFFQk24ZUHag5xr87GGag_n_; expires=Mon, 04-Jul-2022 07:28:01 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame ABED 57 KB
24 KB 71ms
45ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BRUIMjdsG6O0b3R7jdD_qnJohNERFOz9eLUNW5oWJ62nfkLxVmVjN-lUB-x4xJc_IcptwvUZTOOgqniFoTORS7Dbk-o4rE8kYIAaIh03dwFfv-0NLO5o7iVQf9DH9Slcy4OGpWydPpOfLZuC-ZFIH3Wzx82A&dbm_d=AKAmf-CxTYI3GuNQbuhi-Ha6Pudb709-q_-T13wvTuyHaaX3EXi8yFbNt5UnV0v9Ebd3_dD0T2ebVOJtmPQNs7GSo4p65GY2tckogW85f56Wcm8h2PkvhYCkBDkP8gm_McvA_s33aT7djJ71fGu0GMaPLk3DmzlemZSZLdPNT5Utq7N4bJXqGFx0e_TvRulJD3MEjtFzdbSakJrcwUO1oyL-4798-rdmbZAsKfJXK0sH-hHFnB2_q103llsXyr03fn64dsjqGd_wqx_nCriP4T6T0sZhlkxvcEjC8IRMtNcV9ZO-NZgOjiw9nrnXHweW1y_GqqLup9uYCrxlHFa2rLguvQgvGGYsg_EjzFP-OrNIaZL-NyJIZcc2lIvJ2cMTKpP-chGoNdvuUy164vRbjTpzfBBAZAnTYZPqQrsAzt5MI2MoTsoysUTUawlIpJBPFN3pO6gehADgLrbFo6z6PjsOEonh1RiMqOECnJUCQ8Cx_6nyHi0x_4cSGNlt-2611NeLRocIBeOFrmM3MzRWntm4ZgTSbAd4SHVtKKjG4LwzlGWIIfsQugLHOCJIvaWnhmKPixSSqIWtJxvv9HAxYTyvOHNwDJbQzrwF66Gvj1zgqPJd4P28jaAHZgYAlFnxmLO_74IEL0zKLARKmhKpvMvPx6Ag_J5hVFkvqnpaA9vUefmFBH1eC6zlrXVRMcAEahTI88-ipleJGIG0vTWWsEiX7lT4hQt5QFbcl2ACbER2qjwU4Dhl5XJTB7LNp48mOptMpKwJ8cmxwybN48POjjSZSfP_c0xCz5v-3LIz2Qq-R0jNRVLtRxt-ehXiIiZ4IdE_-C23k2YKWfOLaHAdUAIBWqyIHVSlr9-o7qZg7CsoabBb4xXtBYIvRKeZ9XeKueugKVDMESebq0OmY6918MU07kZmWJPWZPuW60STEx8Rl3DopOj-AySIAnJcCZJcaJg5pNzkx5kOk_1wg7lqcAv-vte4e82hb_Erh4V2Fo3097RspRH_QYPTLJ1vmdkUb5Qcl9AaOWYm1my33rguxV4fm-xqfMxJEDzqWi1FYkEcHJg-liPxo3tjbR3XVRsyKa2RypK23vhlqrfBTTDGhc91dZzOI1OolSjWxTaAZrM1xlNEM-AoGDFC2-xQtfR98GUWCvkTnfGrnnQdWm7frChYqys59ciEyDvvhSojLPlk910GzeFzuTWtuGVYBruZyLVNiCPDXP8LWrfXveJWeTlfGRmMJ6rb_wZloMfFKbs9j8ljbZy7mJ0aEpKdrlDBgo2BcECPEa8XNLHK0ntzXK0b8JgQOIawT1u84z9VuW4_RhIOhkanwrK8cO_KHM7H2fuX_cDQzVJ3gu-Am2cu9eGaTcfesMpchuUdy8Ct5jJ8l5gnOd872FvytQa6w_kMHy2iH9IZ9kZu_ZDwwYhxpn71cs5vpI_6IwFVPz28tURXe5n13-v72SZKfZJqfRko7pc9uq5Oj1otui8qN5vyE2fbiPrlPxO1Qt7sy5rT5ixcvxy4lcXxBrD_U7FEDcDrt5EV-TlbwLZpYrs0PXwLTZLNYuN4F7y5tvwz9klQjL0VvLZfIhG8c8JJz-RHO1himqnP3_BgkcCuoxWUAo-nFgof4QasMbI8WteEs7lag2V_yuSPOv4n2ChOCIQn22XqH7iHb1doV8fzTa3k1FDCM4L9XttnH5FSGK-nb6xhkJRn9yX1LrQSZvaJXkVahb6cgnzZG7TvDGQT6q7w2xc3wj-p54lO0lsXihA1mNO8ZhxyBZ_w5WlcRKwgGllglTs_P6uj4U2vsLP2idQznf7Vsci4W_G5kK5QFW2l1kBmkVAP6sU3PE7LQI-IQuLBo5n2lSkXSPkwS7mxJo7Wj3FEzDiIGX4db16PNL08hbGvRtcfH5AFquHW2GSo8kRBW0J9AP-6ng0KuPtHCkNFFWdPkd6RoAx3xu3a6f1OQcjTXoaF9qLFeccJv9Z0QXD7GQOjHELFRJQ2HvE5r9Jq-jzHGVo8y8IHZVfKFP-BayHGxHffkLlTY4AO3nZSKA-yKvzIXJDtQKExGZ_u8dbagn8iXWiqYzeb6fjmMN4YssTxKutt5mty4DjiUXpo6dLQ75XjgZpZJv9pQyD29_H0bZkH9EE5ccGBVnLyTk3IZ4TbZraCny-YR0Eg6dlTM-2lOIH8k38BjNJJMIpyMzayKGiuSaKwEkj4TUbIvetkEB1q95rAcZ9pkZstT5FHNTYW-RwbqgYb_Jyjl6rgbPEwOjm5VHxXbTsaM0UDpY_XljdCCbcPcRGu3mJagtxhvfs9iuBsiSZhplkbgd8hNE0jPiSw8gP1OGlWP715OYgxAOm7vL4XfkPFxusInzTp1TC1lMg_veG2pkoB-LBzUbE2mPwktgD7acyJfAE_D1cTaefoUEgi-XbTble_mIG7KPw3BZOF5fz6JSkzw8WaqvuTNpFdcGb2wA7GMhJ1fEXwJe1Gbj6rhKlmXKU7cjs8YVRejFo2c7yn4dmcF0lzPBz8XSIfKaOrP9LVCSBITK5dW7YhS4WBko79GeZ9l4ub3z-7iexJ23CnavCGCoVie6KMZkfbwiv56tnoMNXIuVjeM_pl4-aTQbsDLtM3WG55e_HzVQdnBavaiUZb00BgL2ZE7tiGLzivhVJjtp3eGQkeCoZNw0AKMVizeSSTFjBBpqpCFz3cE0TQjRVTY73StUTlr9R916DBUcdeJXmLLSkbd1zF1cbh8GwuQr_yU74PKCYQDLTkBp_vE6MvepYTNmEdBz7YxlSH87rKOaj9AIZ7SY0Ql2NsodhnusWXxn4gr4KYXFobulj5qkvQ6oqvoJUI1auoGgz5BTvI4KYwzd4Go05DobfiuDMcloi4eGs6hhrrLzHuSl8aVc42BsbTkHIx_01jOINx3xE5pW83Us_2zsfBwwaU-_JmooHnWZlDxexa10zjsPDNmL0Fj1MQbi64_mfCgKjqFuSVhFrYO8b21cw_i_qv0RdGOEECSxs2ywa-z0mEBjtnVeNGnbyf_sL-is7okWo3IQ1SabRcG7qiUQTfL3shbBusHmH5GeaZKTzPYxKNmhOyL_5fnD7CeASquTCudJl3LHAJ6SiIwUKj2UyjGx1-bjocXimEmyo&cid=CAASFeRoF4JW4g6uqfplRRnnGAjTzYtJ0g&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0394d70a3c02437cebaf5db2dbfb20043d78249aaadb8c2c79ddaf28f94673a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24077
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame ABED 2 KB
1 KB 37ms
11ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:22:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:22:33 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ABED 122 KB
37 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame ABED 13 KB
6 KB 31ms
5ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:25:44 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABED 42 B
498 B 61ms
38ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AGj2ISZQU5Kgl0OP_ceQwKFGXQzQEphJ8yI5YALquzcyE5j-6NUcTpfv2tcYuyGKUgMZRmjkHPBBhgARG31AZ24loogLDtCv-osLcHD-QGc6gKV10

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A138 624 B
979 B 33ms
19ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNWyccEuIbd5r2LtxvkbCmF8kDhBj0oeq8iop65j330_4UXCQH1NVCJfZfUwsgDxy8HpQCNqxOA612LoSL8GenpO0tgU7f1eEtFCVnj7FWmmA-PI0byJnRKTziVOcnwxElF0NlOgPTYJW53On69XqbEDyqqchPRFdmpgwMtxOztoAG-VBts

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNWyccEuIbd5r2LtxvkbCmF8kDhBj0oeq8iop65j330_4UXCQH1NVCJfZfUwsgDxy8HpQCNqxOA612LoSL8GenpO0tgU7f1eEtFCVnj7FWmmA-PI0byJnRKTziVOcnwxElF0NlOgPTYJW53On69XqbEDyqqchPRFdmpgwMtxOztoAG-VBts
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Jun 2021 07:28:01 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUksrGzdm_rqyInIIJHoH59K_SStWjKxLvYBAetsOPlT8XchWmC144DU2oDA; expires=Mon, 04-Jul-2022 07:28:01 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0055 58 KB
24 KB 48ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DvGlHmrK70D4-qku1VVUXMwzThsAIIagcFELbHhvCCNvVq2fYhXZeYC8E0sdhhKMh-_4VuORKqZoI8YLj8kcVb7dewKtz8X4RTfq-Wa1yDS8iVEy2ikZItAaLK05hwcw-MGcuNp715cjTKEIxDc09RErgHPw&dbm_d=AKAmf-AjUWYQAtkgGT0venmNk1rMbu5-c760SQr81t1_ZGoay46oN5amGPrIGnjHGNbf7iABrTB52QliQ0VUYqrmhdBLOWbauI4dco_7v0mAKJMIqDl0erNQt1E6kq08ncDY6W-v8aRelC_euw5p_eulUt_gHRHdF3YgLMkxFHUrEVmztRTgd434BG7mOGPYfZCz2nFZfaBnPOO4SJWuuyti8To3tXap0Lhjcv1rOybEu-RtGE2hglUfjOkOLrPyMzz3yjqXqCUnP33SzCZeAYvcCkzwhUnn-EHnPkeBhgkEKVMuL3_fJdbHwM8qiyTtRrG9IZroU1l7zTF_djep6vGMOZyFdtrhwOU0EYUPMJe0fWGNdWruEf4U-T3EVzKQidrvme8ysyfi_brRbUpreX9kxDUZJ4M3OhLNefvGXy4-qG1Tq80SxDH8atsNNKfYUvm1ZYU_M_oZ18Jz8qs0BoN-WwW1C6i1evG0SZGbaj1X3GKKBVBiDN1yPGpLJD_J0D_3h2fac5RjE59AnNj4VT0gn7-G5wBlnTltMcdr20zmXCKPUjPdSr3z4EtAscoNYwy1J7Kdb6nbL2VNWTkueYxX_CbNPbDYikY1b9y5bL1w693-n0jup83GbcK1FmWadkUsaXG4USsrnbtO53bpcrYXV4JcleTLWT6qKfUmU2mrIEgHpTgT5_nxlE184SmIV7SXLSM55M-pSX_2pWGmFPHxL___5rL51nVm82iAjOn2vDyBMU1GGn-Sgy8YGNE4PKmf94fyXM0K6FQ7VkYnm9bC-tdasZx6L0G7CairywywDq-pUQe7imHJDVRjsWgeZ65WXe2Td-smzdngvGV3-6pKN2iL1dADWZU7pgW1PKaQPNW3DKmyTzoZs_0v8fMM6HJ0-lLmUbx2Spssqk45ltAZGobjBF6lfFLkgmqVgzYHw558g3LhcnAZkMS7wCTe6JU3S4YBVmt6gpjMihrXTE0dLCD4tjlUhr1uhaq8Kno2avgW_OLbVMqHQdmFtsJIgXqVYDcUdL_XJfHh0dj4EP4dYIO75TnaFeumseiqUmFBCGo8ebI1i6tRb4n79Ay51bTKrouUR3LJjsULHVTt-eTWWBQYkXw0vI7x-3rAPqqn8Ssk4jtyQm9C695V0bNRSztQEHjRNy3xkvNk4yw7pGfFvNcNxYy_JqmSR-S6sJ8TIiXjOxNlOo_kQYCHIWPCEfifmaI9UVA1eYuu-l24gEd6u_HaHke9fDi0BIBiSnsppDp0Bd0n7ZGwO01UMWjVwQomynpbTc77vfdvDbq1vQF7NSNvAzGMso6YhGL7Qnu89rNe4m3vgOOxt29s9cxk4wkIwRMHg19gcJ6mplnDhY-01Y9u78S9N2GugUPerIF7apNPalzhPlTF3NOAg2s5Qy_SoCmkj533L7MC4cIkGoIqGmuee9djC_skozCgpQUM3YzHtHW6fC2WrWYdf6nv_09PYIbPd9YUZiE8iMnmp5VppRO-B_fI7fB2G-bA5XQ2KvZWgSG5hZnW41V9ldePtEI3oRuZc8-qITf6SxwYMbb5sgE6fW9sLyC7DK8Cn48bWtJz8teHt0hl8Ilk3fBonAN8VLDRQhLVa0xVrZoCtPgQP0juKyKJ3sgFB_Sjn_SDbVjUBmSI_wWFzuM_GIbPiUBnmJBA_VMR6t9OZjNCHPNmPlK1eKUivaoxP8m3IEidGBlnPJd87JW-9rNrY_4TPfC2-P1TGUYgsBywpG6keok-CkIPkRpkADVkKgX5dvtBSifZiOqPysZST3Vw8MW44ZbgkvB3-2q5JGm7OjCDpPMDSr_uh_p_wtmF7iWUjmaMfLPkEUICQ76bcYowvuja0wbyBYlO0fkkWmWknb2hu9IRT6fplDFAPj83dWbWAVqXA9-cpiJVNRLFPLE-uSsAPH_AaX6j4b9sSCgcqZ7o25bYkQd8xIK0rP10snYlfyXQmtNK3gkRyQdhI3jezaLOvKOSGgbkjkWgZPMg5gMnpCQUFMV85KHOL6uA-IIFx34dltZG0JLR2wI_mzXqfm-GJKI2k-adETt1GNnRnJZd8LXWtjskDuSOV9ckYtyXFOmtQ2yJZVEv5LURoLkAlwatwKrp66OrC2VS3565rWoshN0fF0MEVUnXtBuKL-dpjv1By9z_X-jFW9aaXfbNCRQGfZv3c5OTXKXACWSJzBOm49f7OkUKDEEd3NV7by1R5w6wQ9_HzjaJjdHOThYFodBz_MLilCIfNpgTyyxknpcG2UhwhoeCd1CAYrj3cc_2kiAUKNzfzduhKgJZ7wQbOTfvpf3AeYHxkeiFC8dR2gsoxnPclXSjOFTHiy1FoJFRwDfO-02tamwmaa7MoAxsiEcP9xyCRHp_-dGYQgojINVrPnHU07nWtTvWQ9v8SpREe2tWZGK99G5VYECBW8qXvsZ_M52hkgNBMlhjaN80_0FTyKPWILWkzAOZssR9ID8MdBSGsTwTDbQd-wNaWlmA0eNMgmSywZhDdTrvgDGf60-MaeHIqAv84l6oPit3_-ss2WgVOeWEIEG3Nt9F1CJUzVVtiMB9I6qM3GDpSAdEbS2LSSN2TrUJel3xiMxW5NQqNQ8CX4LWcBEq07JR9P4DTZfAbzZryPSLH7eMRoOU129wQPNINOkys4dxDXo3gnUteOc7ic5RIm47gON1u5l4BlJc0e8XmxNN4mw88476PexoLgpSLlwuCIFYqqacJ_IQaw1DsKmrlF425rdQ0e8o8r4iYYifgySN7RjvaUh_RsuDvIV97SwcEqNMOj9_YEzhan3eioQb3mC6_3Hfe8N07OpaxwIxJBHV_8nbrYC9c7F-NLw0OERIWr5rl-Hjxfi1k3_HXkIqAf9faW-UR3vdTKpMs7R5U80Blio7-Z2omm8pIMWLWCez5-fxqLfzFsq47exxbEbbLRth_4aPM5Xp4UGKLx_uw-qMdIoHrYIfxU6MgOZRqSZVXQx06yQGuwXG8N_J4zRvNdmMwvbatZ08ydzQ0Vq282N1K_AVAzftUeMIfJHqzSIShj9wA8gtvFUwVCa7AdOKKra7sFb-EdNfWxZ0mcChSXQYPFxGlcIQqyPOdNhgR5UaVrxnps4F-UK56mzIxbm-m3mLRiG_6fygXGKALCbB08ew4rH0&cid=CAASFeRoEGe8K1RQ6TFgzyWuSHnGHaLyfw&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

af094c3b412db964b50d48f21abe3696480bd90350167a78bf1828a6bf10437d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24143
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 0055 2 KB
1 KB 21ms
12ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:22:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:22:33 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0055 122 KB
37 KB 18ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 0055 13 KB
6 KB 16ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:25:44 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 0055 0
0 22ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRhc0w1NFhGDEESOmDc_5W8gMIgjQ9I2IFmcXTVdiF9AW8bvT-30fBzDkCd6_tI5Gqn4a169vTxNnGwTqutQu0muwDsag
Requested by: Host: prnt.sc
URL: https://prnt.sc/14oeka3
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0055 42 B
63 B 58ms
39ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CpOroqh3DTDa6pZxeqsIKdxAuQSVQxSwqDoRi8LcdFgBDekduy_MT5xTPyVpXVLicEwSgp34XpM8bvmPCqB2H32U28MkKTv8r_hZdNKpp4dWAinDM

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0866 624 B
560 B 28ms
22ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhjNo5GWATAB&v=APEucNWCa5GaxPdywADoYQXTaFEVy6ogge51CMR9KoyLIedb1hw6T95pmUjHjhflAIwWmEr-GnbTVmpCL12IEAeDHmCoLHaFNAiU5MpMbsqm1BDQXnpBQGdb3kRBwrd80YTYJdzjAQxi8rp_Z7-345BtormKRSVKMGNjljVXmPSpQ9aAQKJZpaM

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CMXlgQEQ1K6oAhjNo5GWATAB&v=APEucNWCa5GaxPdywADoYQXTaFEVy6ogge51CMR9KoyLIedb1hw6T95pmUjHjhflAIwWmEr-GnbTVmpCL12IEAeDHmCoLHaFNAiU5MpMbsqm1BDQXnpBQGdb3kRBwrd80YTYJdzjAQxi8rp_Z7-345BtormKRSVKMGNjljVXmPSpQ9aAQKJZpaM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Jun 2021 07:28:01 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUk9G5GXbxWWxhRtnoDBWv-OZXDv-kLx07mmZeBQU-XlLmfhe96VmTT0OU2V; expires=Mon, 04-Jul-2022 07:28:01 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CA86 43 KB
21 KB 40ms
34ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DhpoMGwO-Lua5p2xsr35yQaYqSk5_meKRyILPsB9EhDDj6nvY7T47uv_BG_euVfHALBr9AeYxSqpq1xvMloTGmOls5Ce4tx0yaaVMFS0iVHf0YhqkEnwAV4hJrTJUsupLV6BE9YJ_9I33sJwI5dKX0zo9bjg&dbm_d=AKAmf-BuONBcDnVsQPv0etUya89VfFxgNZuiOMvrHfQ9cz3nZxjh6T7xTiWiZqN81Jgh11PqVgRdfx04NoiAMWMK6sJPfjIOQCh-E2pTu55sh8_gSNbeFTcIGt8MjE63RYY6mCPEdd4THPll5iy2VH_hwLoZLAmiiUcPNgXtc4gsy1enaMEWZwJRKXEkNz3w_HtEV46TT02bAXPCbqPBMkQZDg_pcfdg37mnzlDxE8IKShWdtYwCIrX3r3YnhIZgywSqe4fk7726LQbeFDspAlpqTI5q94u3H87lbFGYrkROfGRp5KbZ8fE5jThM5NHUuP2dTzZyh0byP6HLj_8fRgs1Yzlfqwaz-xeLHyh4Um-VKECiPEiEbR2me4TTb7uMKjwuZe8JjGTeo-6CJ9Dq-0lu22uYwIVaVK9K5Z7hWSrX8qNbSToGCk8eF6jwlORYXmhKcyTsdZkbUHKCNA75FddyWdPmn7x8LRte2M4o1kAqIEnV8nw8fHhakogstPOpOpWSxtNVm3i5r_b0fUQ9DbJsOqIjHgbF5A1kIaolpZBxByyFZ79KYJHpvQ829HGhpCqdCuuT2Bin5Tn-Zo5D8eS3bniDOlXK1Iq6JyAE9kCDsxZXCfZYVFSusJr_zYmezrsc_ig0eieFe8aUdM75rD0RRP0IDiExhmHENSX13lGNhtOyBoIKKw_wKRM5WRAZrEdiFs5AfgqXcJHE-2WVHkBGbQtv8GQ9HHT8Y8z7H--HgP1w0a0pRlBT7Di8FNtLyLtxwW6kUJ2tlhxBeb9iyoH5wkTTd13LlZCjuwFjRgsAXqx4VEQTdIUpRXxgg4QdrI26mQqedCXZ5iXrB16Jk5AAC3MZsYKbDGSS13xNxjtGeDn8t4OZNRTcD82EkpL5yW7iQKpt1kbpA648JfPUQvAcR5BsM9FMkLmPKWqnFcFodweqWJ6S0C6ltTKVvodSfBemAk2IoTlmopT8yqgFefR-QrBPMGaz0agHyYpIYpD2dg30QDW6iweq-n0yfiCFGSPMkzPaATqC7x5PIPtuWgpXOfTuGkylBOYsm98BUV1xpLZzNSyzDmVjqzcf9Xvx1Ni5lKSwdM2mS1Ms9RcGsffr1k7EpPnReZzrLBYg9gnKeSOYSxfw3IrxvvBx9oL3VgrKxNe7w0aooUraZS_jeXVIFpMqCM7nwQpxgK2qTpIcJ0L8RR4arYU9Ui-d4gp3j6m9_X5i6j7fcYDMBNYz0EKJiX0s_bVqVRyZeeCJ4W5kE-lDOKop0ELMm83dkXfQsyOUpheXELTq2r-JzN_-3U1xQ6dpCDF9489A-RhyeL9_5uRLE_kEuM130LUoCTjlrGojBQzLK5V17d7GRfOVFwZUoXmYFhS2oLS_w85Khw6JhpG1mERXivqv_li3fCagUYUEUicAbRIjlKdMQobyLOOAIWkMUFe1GnbMbdiBgMS2s6h8ZDFK5z0TYeHgFgoSAatjGILpYnr89ZYtjBvBjXxW1uoYZdRiJyqkE_Hn35f11cHyJPnuyFRl8_HqlLUI6ablcEx-Lmo_tF5B_qsUOWUCTctCFXFPdtESNSqvLRsEIMm2woCQ_WHCwI_LujlzghDhAoqEnlnvFRT8KtKwuj7cXgCDSW_SFz1IxASPXljflnbo3HV-qtFxyjTLTKBWV0VqH5gyAOdnGSJ8OR13WYaJn_bV_vIZ1r8sWSdIz4-Hgw-DrMdqwIyHxbOwik5unJEJFOoFS1412apDF-6j2U83iy8iC6vaFGs48AXNx4lkIXgLqU-LJiblsJyFE8Nj6YHz6nXTQ_0-auIosH81Ebq16zgMAguHHTYSzgBjHGJ-wUy0MJNjarKRpk90qCRAxrbBmdWz0oWLUYA1OiikUZEnrVU_0uJt35ZNC9U1ZXpFv-NE4rkLA7SBSnQKiBG8x99ajdEnKLVz1MtX2qd0b6U4i89xpkMPFAJY7TmSD_ZTUxT03KzNSwcvVfYtWmJwRT7zwzqqWoIfRzj5AGf1SPzw5knrWO9irwoNqa2Od15jHdss26oSg2cN0z5DVEkomHbKlp2c2opD5zn-AGL9M8aeB8cXRnPN-zJB7C80poFAbG22DUKKh99nsY3edktWnhNuoSH7ucDj1yru6WpmWKrWKmosTk1y6BMf1a-Kkb93WSrsClv_aMPmDMeT1y8yoKfyOwRMeh1Rj0_Cgv10YlFLc0EAk6VJN-4kmcPk-sel4SLHfcglJxi8zFbDDcn4l34JsQlifnG7Rs21S0T89xCX0bAzapGzPgOvZG8mhvzYSxrOnt1mUnk3oTsUziYeK86Ijg9W9pnqXDGrxdV2pAJEbAjtRn0HhcPI2heDRV5KSVV1DhH7MBSQi-ZnEmdlEtZv3_tYYzwBKlEYeXuiqVDx5d7SIjZDZ1KBBFJQE4QPNUAMNspl1Y9FAQcGhsBcYCexXTBBzvnOYqw6OiNJisktj06BtskmFXn05FTACCPM5a_aEzAxrpmicV2buZQFe6DIbGE37aqvfoegD7F-ouP3hMGFYbKE5M2KIylTw0IRtvVBFlIOfUVcJtNVEcpdMXQQu_iWx4Bl4wwCPx2hyz5UWayEEqqQ_t_ZrvbQzWlYjTkwIL0nO8GqmWm7i_r30FPB3fZmSukXKxE9F-n0xelc89EV9twnE8JrmN-n6PHTBQEEctUBpd6I2DpOYmt4mShar0nBHXmCbSa8GrqB8k0h5P62XuQnMPe-z2MkWJa5VhWTAZ9fjh0zj8tzyUrLDQCVBlmGJjR7aV1Kzwjhm7ECgbg9hX1GLPxsvk3y-j5IMgKqxH0kOH8o712OQyADiSfE87gkh1vICZcbhDOwKgJSg3kSZ7F0dsKOjVkLcX7pqW2uTdMAOIW2R4ZRsgJiWYIXm1wNLx4_YSmoAcXHvc_8WZUboRHKyiOZue3YOpUfbKmrs8_jyvURhUsM0na_rOUqLYqvrqvWYt6huXWJWEWWeXltbuqkuqpGYQyTawfxA-xSUQNGwJZNv4Q6N52vZtV64bTkUm-SHSY1THTh-vuUXGJohI49dvVKJpXw9OPkuy5gJWWa5hZf0Wc4qxkZns2_LzacSaUqsDoQ8wzSHP6dC_e1JRATdBC9IispBEa1psWA-VDpsG1nZNC9_zYOsPOLl2qX414jpCBegvroesIyy2qSFv-ihItnBUC5uQY2_eTs-4gLtVQ&cid=CAASFeRopddTnHPjktipVM8usBuqHIKwEA&rfl=1%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e73b7a821da967fead7baf9c750f3d2e710275b83151c0dd48d6d8524a6fa8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21041
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CA86 42 B
63 B 57ms
39ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ak15IKBDWCgXEux3nZoKFA-cHKVsdLyyAiKMiQFI0lVoklsp0C91SwBAyFfYE3Y7-PeRZmDy6wk97Ai-CW8TPLAb3vWHaDUjWGLHQEIdZWL8eAUfc

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame CA86 2 KB
1 KB 17ms
11ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:22:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:22:33 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CA86 122 KB
37 KB 18ms
15ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame CA86 13 KB
6 KB 16ms
11ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:25:44 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 18ms
15ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622653785071769"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/223/ Frame 1FF9 12 KB
5 KB 20ms
5ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/223/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Wed, 09 Jun 2021 07:11:06 GMT
expires: Thu, 09 Jun 2022 07:11:06 GMT
last-modified: Wed, 17 Mar 2021 18:24:30 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1015
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame EF51 783 B
532 B 21ms
17ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

840bc0ba7ae91b102bc97b6204aa92e72611807cdafeaeb2b5260efcc10cb1da

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Kti2eWb5IOYs0nqxZi/UZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

expires: Wed, 09 Jun 2021 07:28:01 GMT
date: Wed, 09 Jun 2021 07:28:01 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-Kti2eWb5IOYs0nqxZi/UZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A138
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1

43 B
1014 B

54ms
45ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNWyccEuIbd5r2LtxvkbCmF8kDhBj0oeq8iop65j330_4UXCQH1NVCJfZfUwsgDxy8HpQCNqxOA612LoSL8GenpO0tgU7f1eEtFCVnj7FWmmA-PI0byJnRKTziVOcnwxElF0NlOgPTYJW53On69XqbEDyqqchPRFdmpgwMtxOztoAG-VBts
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 07:28:01 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A138
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMBtgTgAfR03wETMtUePtgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1

43 B
894 B

41ms
41ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNWyccEuIbd5r2LtxvkbCmF8kDhBj0oeq8iop65j330_4UXCQH1NVCJfZfUwsgDxy8HpQCNqxOA612LoSL8GenpO0tgU7f1eEtFCVnj7FWmmA-PI0byJnRKTziVOcnwxElF0NlOgPTYJW53On69XqbEDyqqchPRFdmpgwMtxOztoAG-VBts
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:02 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 07:28:02 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame A138
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJuauNZwJeC2shY0CHjw95I&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJuauNZwJeC2shY0CHjw95I%26google_cver%3D1

43 B
1 KB

52ms
30ms

Image
image/gif

37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJuauNZwJeC2shY0CHjw95I%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNWyccEuIbd5r2LtxvkbCmF8kDhBj0oeq8iop65j330_4UXCQH1NVCJfZfUwsgDxy8HpQCNqxOA612LoSL8GenpO0tgU7f1eEtFCVnj7FWmmA-PI0byJnRKTziVOcnwxElF0NlOgPTYJW53On69XqbEDyqqchPRFdmpgwMtxOztoAG-VBts

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.247:80
AN-X-Request-Uuid: b91df909-2087-492d-b273-926bf9d7b1c5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.211:80
AN-X-Request-Uuid: fc22da68-a014-4fb7-8534-91c6695b3091
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJuauNZwJeC2shY0CHjw95I%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A138
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ0MTE0MjA5NDYzNzg1MTM0NA%3D%3D

170 B
188 B

42ms
41ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ0MTE0MjA5NDYzNzg1MTM0NA%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.136:80
AN-X-Request-Uuid: 0ce3bab3-a792-4825-8522-111df68016c4
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ0MTE0MjA5NDYzNzg1MTM0NA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CBEC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1

43 B
1014 B

3416ms
3336ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNW5_6Pl30gciA8YvnfC8Y8S4LVKJkagoXAEm6reB1W5akIjPeMhHBeAZ_iRjOkvYqzUmGXtnB52D7rzeBdsz2wUfR5N7tzcyEJexmejGh5qOaATx_MU2Gbe2WHM04JTMvh4QCuGnk3QsLq9fmFsOtdGRmkpBr5-v0Nw3f4dO1agbSBDiik
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 07:28:05 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSoMiT7RIOmOioW00E8b60&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CBEC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMBtgTDfB4Kaa6Xm.Kf.ygAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1&google_hm=2

43 B
1014 B

42ms
41ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNW5_6Pl30gciA8YvnfC8Y8S4LVKJkagoXAEm6reB1W5akIjPeMhHBeAZ_iRjOkvYqzUmGXtnB52D7rzeBdsz2wUfR5N7tzcyEJexmejGh5qOaATx_MU2Gbe2WHM04JTMvh4QCuGnk3QsLq9fmFsOtdGRmkpBr5-v0Nw3f4dO1agbSBDiik
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:03 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 07:28:03 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame CBEC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEMamPvdggjJ0s5MHpV8bzs&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1

43 B
1 KB

114ms
33ms

Image
image/gif

37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKOLtKwBMAE&v=APEucNW5_6Pl30gciA8YvnfC8Y8S4LVKJkagoXAEm6reB1W5akIjPeMhHBeAZ_iRjOkvYqzUmGXtnB52D7rzeBdsz2wUfR5N7tzcyEJexmejGh5qOaATx_MU2Gbe2WHM04JTMvh4QCuGnk3QsLq9fmFsOtdGRmkpBr5-v0Nw3f4dO1agbSBDiik

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.104:80
AN-X-Request-Uuid: f01841c6-1274-4a56-8455-8e3a6b4a918b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.89:80
AN-X-Request-Uuid: 3c058366-5335-4dc0-930d-d800ec18ed6d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame CBEC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU1OTQ3MTAzODg4MzEzOTUxNQ%3D%3D

170 B
188 B

42ms
41ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU1OTQ3MTAzODg4MzEzOTUxNQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.203:80
AN-X-Request-Uuid: 450a49ea-61c3-4fe0-95b2-9e0f29f913bd
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU1OTQ3MTAzODg4MzEzOTUxNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0866
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEJkVfqpUj_Gc3imZOuf3ss&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEJkVfqpUj_Gc3imZOuf3ss&google_cver=1&C=1

43 B
1014 B

94ms
40ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEJkVfqpUj_Gc3imZOuf3ss&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhjNo5GWATAB&v=APEucNWCa5GaxPdywADoYQXTaFEVy6ogge51CMR9KoyLIedb1hw6T95pmUjHjhflAIwWmEr-GnbTVmpCL12IEAeDHmCoLHaFNAiU5MpMbsqm1BDQXnpBQGdb3kRBwrd80YTYJdzjAQxi8rp_Z7-345BtormKRSVKMGNjljVXmPSpQ9aAQKJZpaM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:02 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 07:28:02 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEJkVfqpUj_Gc3imZOuf3ss&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 09 Jun 2021 07:28:01 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0866
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMBtgTgAfR03wETMtUePtgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1

43 B
894 B

42ms
42ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhjNo5GWATAB&v=APEucNWCa5GaxPdywADoYQXTaFEVy6ogge51CMR9KoyLIedb1hw6T95pmUjHjhflAIwWmEr-GnbTVmpCL12IEAeDHmCoLHaFNAiU5MpMbsqm1BDQXnpBQGdb3kRBwrd80YTYJdzjAQxi8rp_Z7-345BtormKRSVKMGNjljVXmPSpQ9aAQKJZpaM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:02 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 07:28:02 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDuPGKhKWK8KYc-n4lkfCwU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 0866
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEMamPvdggjJ0s5MHpV8bzs&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1

43 B
1 KB

111ms
32ms

Image
image/gif

37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhjNo5GWATAB&v=APEucNWCa5GaxPdywADoYQXTaFEVy6ogge51CMR9KoyLIedb1hw6T95pmUjHjhflAIwWmEr-GnbTVmpCL12IEAeDHmCoLHaFNAiU5MpMbsqm1BDQXnpBQGdb3kRBwrd80YTYJdzjAQxi8rp_Z7-345BtormKRSVKMGNjljVXmPSpQ9aAQKJZpaM

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.211:80
AN-X-Request-Uuid: 9d864a72-616e-48aa-98a9-cc0775068273
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:01 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.152:80
AN-X-Request-Uuid: a288e416-7e5d-4907-a495-3201786daa5f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEEMamPvdggjJ0s5MHpV8bzs%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0866
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA4NTU1MjY1MzQzMzQxMTI4MQ%3D%3D

170 B
188 B

41ms
40ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA4NTU1MjY1MzQzMzQxMTI4MQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 07:28:02 GMT
X-Proxy-Origin: 82.102.18.235; 82.102.18.235; 692.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.237:80
AN-X-Request-Uuid: 88a9ca1e-3ada-4429-b86d-959492d4fe59
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTA4NTU1MjY1MzQzMzQxMTI4MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame CA86 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DhpoMGwO-Lua5p2xsr35yQaYqSk5_meKRyILPsB9EhDDj6nvY7T47uv_BG_euVfHALBr9AeYxSqpq1xvMloTGmOls5Ce4tx0yaaVMFS0iVHf0YhqkEnwAV4hJrTJUsupLV6BE9YJ_9I33sJwI5dKX0zo9bjg&dbm_d=AKAmf-BuONBcDnVsQPv0etUya89VfFxgNZuiOMvrHfQ9cz3nZxjh6T7xTiWiZqN81Jgh11PqVgRdfx04NoiAMWMK6sJPfjIOQCh-E2pTu55sh8_gSNbeFTcIGt8MjE63RYY6mCPEdd4THPll5iy2VH_hwLoZLAmiiUcPNgXtc4gsy1enaMEWZwJRKXEkNz3w_HtEV46TT02bAXPCbqPBMkQZDg_pcfdg37mnzlDxE8IKShWdtYwCIrX3r3YnhIZgywSqe4fk7726LQbeFDspAlpqTI5q94u3H87lbFGYrkROfGRp5KbZ8fE5jThM5NHUuP2dTzZyh0byP6HLj_8fRgs1Yzlfqwaz-xeLHyh4Um-VKECiPEiEbR2me4TTb7uMKjwuZe8JjGTeo-6CJ9Dq-0lu22uYwIVaVK9K5Z7hWSrX8qNbSToGCk8eF6jwlORYXmhKcyTsdZkbUHKCNA75FddyWdPmn7x8LRte2M4o1kAqIEnV8nw8fHhakogstPOpOpWSxtNVm3i5r_b0fUQ9DbJsOqIjHgbF5A1kIaolpZBxByyFZ79KYJHpvQ829HGhpCqdCuuT2Bin5Tn-Zo5D8eS3bniDOlXK1Iq6JyAE9kCDsxZXCfZYVFSusJr_zYmezrsc_ig0eieFe8aUdM75rD0RRP0IDiExhmHENSX13lGNhtOyBoIKKw_wKRM5WRAZrEdiFs5AfgqXcJHE-2WVHkBGbQtv8GQ9HHT8Y8z7H--HgP1w0a0pRlBT7Di8FNtLyLtxwW6kUJ2tlhxBeb9iyoH5wkTTd13LlZCjuwFjRgsAXqx4VEQTdIUpRXxgg4QdrI26mQqedCXZ5iXrB16Jk5AAC3MZsYKbDGSS13xNxjtGeDn8t4OZNRTcD82EkpL5yW7iQKpt1kbpA648JfPUQvAcR5BsM9FMkLmPKWqnFcFodweqWJ6S0C6ltTKVvodSfBemAk2IoTlmopT8yqgFefR-QrBPMGaz0agHyYpIYpD2dg30QDW6iweq-n0yfiCFGSPMkzPaATqC7x5PIPtuWgpXOfTuGkylBOYsm98BUV1xpLZzNSyzDmVjqzcf9Xvx1Ni5lKSwdM2mS1Ms9RcGsffr1k7EpPnReZzrLBYg9gnKeSOYSxfw3IrxvvBx9oL3VgrKxNe7w0aooUraZS_jeXVIFpMqCM7nwQpxgK2qTpIcJ0L8RR4arYU9Ui-d4gp3j6m9_X5i6j7fcYDMBNYz0EKJiX0s_bVqVRyZeeCJ4W5kE-lDOKop0ELMm83dkXfQsyOUpheXELTq2r-JzN_-3U1xQ6dpCDF9489A-RhyeL9_5uRLE_kEuM130LUoCTjlrGojBQzLK5V17d7GRfOVFwZUoXmYFhS2oLS_w85Khw6JhpG1mERXivqv_li3fCagUYUEUicAbRIjlKdMQobyLOOAIWkMUFe1GnbMbdiBgMS2s6h8ZDFK5z0TYeHgFgoSAatjGILpYnr89ZYtjBvBjXxW1uoYZdRiJyqkE_Hn35f11cHyJPnuyFRl8_HqlLUI6ablcEx-Lmo_tF5B_qsUOWUCTctCFXFPdtESNSqvLRsEIMm2woCQ_WHCwI_LujlzghDhAoqEnlnvFRT8KtKwuj7cXgCDSW_SFz1IxASPXljflnbo3HV-qtFxyjTLTKBWV0VqH5gyAOdnGSJ8OR13WYaJn_bV_vIZ1r8sWSdIz4-Hgw-DrMdqwIyHxbOwik5unJEJFOoFS1412apDF-6j2U83iy8iC6vaFGs48AXNx4lkIXgLqU-LJiblsJyFE8Nj6YHz6nXTQ_0-auIosH81Ebq16zgMAguHHTYSzgBjHGJ-wUy0MJNjarKRpk90qCRAxrbBmdWz0oWLUYA1OiikUZEnrVU_0uJt35ZNC9U1ZXpFv-NE4rkLA7SBSnQKiBG8x99ajdEnKLVz1MtX2qd0b6U4i89xpkMPFAJY7TmSD_ZTUxT03KzNSwcvVfYtWmJwRT7zwzqqWoIfRzj5AGf1SPzw5knrWO9irwoNqa2Od15jHdss26oSg2cN0z5DVEkomHbKlp2c2opD5zn-AGL9M8aeB8cXRnPN-zJB7C80poFAbG22DUKKh99nsY3edktWnhNuoSH7ucDj1yru6WpmWKrWKmosTk1y6BMf1a-Kkb93WSrsClv_aMPmDMeT1y8yoKfyOwRMeh1Rj0_Cgv10YlFLc0EAk6VJN-4kmcPk-sel4SLHfcglJxi8zFbDDcn4l34JsQlifnG7Rs21S0T89xCX0bAzapGzPgOvZG8mhvzYSxrOnt1mUnk3oTsUziYeK86Ijg9W9pnqXDGrxdV2pAJEbAjtRn0HhcPI2heDRV5KSVV1DhH7MBSQi-ZnEmdlEtZv3_tYYzwBKlEYeXuiqVDx5d7SIjZDZ1KBBFJQE4QPNUAMNspl1Y9FAQcGhsBcYCexXTBBzvnOYqw6OiNJisktj06BtskmFXn05FTACCPM5a_aEzAxrpmicV2buZQFe6DIbGE37aqvfoegD7F-ouP3hMGFYbKE5M2KIylTw0IRtvVBFlIOfUVcJtNVEcpdMXQQu_iWx4Bl4wwCPx2hyz5UWayEEqqQ_t_ZrvbQzWlYjTkwIL0nO8GqmWm7i_r30FPB3fZmSukXKxE9F-n0xelc89EV9twnE8JrmN-n6PHTBQEEctUBpd6I2DpOYmt4mShar0nBHXmCbSa8GrqB8k0h5P62XuQnMPe-z2MkWJa5VhWTAZ9fjh0zj8tzyUrLDQCVBlmGJjR7aV1Kzwjhm7ECgbg9hX1GLPxsvk3y-j5IMgKqxH0kOH8o712OQyADiSfE87gkh1vICZcbhDOwKgJSg3kSZ7F0dsKOjVkLcX7pqW2uTdMAOIW2R4ZRsgJiWYIXm1wNLx4_YSmoAcXHvc_8WZUboRHKyiOZue3YOpUfbKmrs8_jyvURhUsM0na_rOUqLYqvrqvWYt6huXWJWEWWeXltbuqkuqpGYQyTawfxA-xSUQNGwJZNv4Q6N52vZtV64bTkUm-SHSY1THTh-vuUXGJohI49dvVKJpXw9OPkuy5gJWWa5hZf0Wc4qxkZns2_LzacSaUqsDoQ8wzSHP6dC_e1JRATdBC9IispBEa1psWA-VDpsG1nZNC9_zYOsPOLl2qX414jpCBegvroesIyy2qSFv-ihItnBUC5uQY2_eTs-4gLtVQ&cid=CAASFeRopddTnHPjktipVM8usBuqHIKwEA&rfl=1%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:23:58 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame CA86 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:22:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 351
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:22:10 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame CA86 0
575 B 121ms
53ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv56u2T1x_TgXgAjMYbBg5PihI6io-4KXkUw6Qoae9zlrZrl4QgUS9pHvQqbYRZYZGdJCg8Gsyqft2xmgfVl2btshlHpFJ8cqKDJtfsmuhjEK6Ck4J4nxo9jsmlqC4J7ZWrQuqrTkCsILJD-l2aqh36DbKChhcf1MlWs_lsdCdQclw06GPI5-neTZgiiolWlSUN869MCyAAyj_eYFRfbJLSbua9YHM08hc0pQ-JMNJXGNq0-DBthXRm5crHauxodCVBpJgvu5VP2p-rolWRe7F_1wmJMof42cMWT5tBUF0CCVTw4zMTRxMp_uGjHUgaUHDA1n7yvzprTSrGlkWcvX1vcq5kMR7NQfL9SIyD8EPL2uOE5DBC-xcRWuQAMGSNMrPtHI2k2ijCVVHNrhBMPoJrCS1zuL-ZuojKeFxu3Qs6HwFc8yAaTy2-R2_wkWfPteJfcAkrJ_B7nt_jXfNd836RI3h24MEXX00cqUIwstGZI9Ync0M-5ECcPg5V_pXtd6W7SoWxtrm8frwULycC2cwjx_qyJG5f17BFOkhp1OiXzfWpLEkrO95SBIFTgg_FxQn0mhhgfI7XAmRLZC5H29lAnP-FvRwMziGFzy5slHrO8TP-wUHoAqb8LYm_dz5RnSl2P747iB4NMt-ca8u2-G8LZhPPdVHU_IWeabnOolv5HZv8sAL-CqYnH6MSszl3lA4MdhJsJXUmfbe4ce39BwO94IB4aqWUWBlqx5wbnpZMPQ154R-i3cNzfO9gcp4oWKLesOQqEHvL3QI_CRQTxvbgU1KbYIV-bgg-HsNuUgD4H8hb8SJifeT1VwvpN3gcjusBNaAtte7TctydjM6Nul_C2XAOb76g7N7i5NXmwRND2VLNl1pgzM4CrW9Chap25rHzMRsANVW_Cy7sOoa9UfT2sPmEh102-NlW0bYWsFfgPLb8X0n2rz_NEH8WSQP0X7d_G5oh5xFY0Hm0oWvj-CSipyLpjA9C0hS9SXT_PLVyMy-wj6GdXkGVEz0KIxD5A_0xsbJw5c_7ONshpcmbyIyBPWj9-rZcGqV7XpZHJGTIKI8Ad5QQ3nPyznNmhRZJnQLGQR5Pje7PHWl8nI7G5WDwPzX28UNfN4mPEFrmN0xE4GOEXnmNtJ57dh44ddQHkfPQ8gwQJjYyUu10Vx8TvvQe0B8BqFVFwWUDayFkYNP1H-nRZpcck_kMM2Snyg&sai=AMfl-YT6vlKZigEckkqFYfG5TXdCrgyKYwXXEv_PsicdpBP7yV8A4vMZepukLVN25p7GMU426NllQD48pCZ1Nlu1GYuCANt5bbRxdlaiIjoJVBZAmnCxbShSwChJxiISlCqf2qfarkxawR_D7kXIqZ77ha53efnkpPqEy9D42X8&sig=Cg0ArKJSzILhUhia9LOUEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210607.50325&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Jun 2021 07:28:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame CA86 41 KB
15 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:19:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4120
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Jun 2022 06:19:21 GMT

GET
H2 200 FR_On_M1_GDN_300x250.png
s0.2mdn.net/9504762/ Frame CA86 20 KB
21 KB 28ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9504762/FR_On_M1_GDN_300x250.png

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f3376b9a097bee1c7aef14cf2b85d5211639d06401e3435aceb5fc790d6e525

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 20:51:38 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 14:56:47 GMT
server: sffe
age: 38183
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20763
x-xss-protection: 0
expires: Wed, 09 Jun 2021 20:51:38 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 0055 111 KB
39 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 19:28:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Jun 2021 19:28:17 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame 0055 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DvGlHmrK70D4-qku1VVUXMwzThsAIIagcFELbHhvCCNvVq2fYhXZeYC8E0sdhhKMh-_4VuORKqZoI8YLj8kcVb7dewKtz8X4RTfq-Wa1yDS8iVEy2ikZItAaLK05hwcw-MGcuNp715cjTKEIxDc09RErgHPw&dbm_d=AKAmf-AjUWYQAtkgGT0venmNk1rMbu5-c760SQr81t1_ZGoay46oN5amGPrIGnjHGNbf7iABrTB52QliQ0VUYqrmhdBLOWbauI4dco_7v0mAKJMIqDl0erNQt1E6kq08ncDY6W-v8aRelC_euw5p_eulUt_gHRHdF3YgLMkxFHUrEVmztRTgd434BG7mOGPYfZCz2nFZfaBnPOO4SJWuuyti8To3tXap0Lhjcv1rOybEu-RtGE2hglUfjOkOLrPyMzz3yjqXqCUnP33SzCZeAYvcCkzwhUnn-EHnPkeBhgkEKVMuL3_fJdbHwM8qiyTtRrG9IZroU1l7zTF_djep6vGMOZyFdtrhwOU0EYUPMJe0fWGNdWruEf4U-T3EVzKQidrvme8ysyfi_brRbUpreX9kxDUZJ4M3OhLNefvGXy4-qG1Tq80SxDH8atsNNKfYUvm1ZYU_M_oZ18Jz8qs0BoN-WwW1C6i1evG0SZGbaj1X3GKKBVBiDN1yPGpLJD_J0D_3h2fac5RjE59AnNj4VT0gn7-G5wBlnTltMcdr20zmXCKPUjPdSr3z4EtAscoNYwy1J7Kdb6nbL2VNWTkueYxX_CbNPbDYikY1b9y5bL1w693-n0jup83GbcK1FmWadkUsaXG4USsrnbtO53bpcrYXV4JcleTLWT6qKfUmU2mrIEgHpTgT5_nxlE184SmIV7SXLSM55M-pSX_2pWGmFPHxL___5rL51nVm82iAjOn2vDyBMU1GGn-Sgy8YGNE4PKmf94fyXM0K6FQ7VkYnm9bC-tdasZx6L0G7CairywywDq-pUQe7imHJDVRjsWgeZ65WXe2Td-smzdngvGV3-6pKN2iL1dADWZU7pgW1PKaQPNW3DKmyTzoZs_0v8fMM6HJ0-lLmUbx2Spssqk45ltAZGobjBF6lfFLkgmqVgzYHw558g3LhcnAZkMS7wCTe6JU3S4YBVmt6gpjMihrXTE0dLCD4tjlUhr1uhaq8Kno2avgW_OLbVMqHQdmFtsJIgXqVYDcUdL_XJfHh0dj4EP4dYIO75TnaFeumseiqUmFBCGo8ebI1i6tRb4n79Ay51bTKrouUR3LJjsULHVTt-eTWWBQYkXw0vI7x-3rAPqqn8Ssk4jtyQm9C695V0bNRSztQEHjRNy3xkvNk4yw7pGfFvNcNxYy_JqmSR-S6sJ8TIiXjOxNlOo_kQYCHIWPCEfifmaI9UVA1eYuu-l24gEd6u_HaHke9fDi0BIBiSnsppDp0Bd0n7ZGwO01UMWjVwQomynpbTc77vfdvDbq1vQF7NSNvAzGMso6YhGL7Qnu89rNe4m3vgOOxt29s9cxk4wkIwRMHg19gcJ6mplnDhY-01Y9u78S9N2GugUPerIF7apNPalzhPlTF3NOAg2s5Qy_SoCmkj533L7MC4cIkGoIqGmuee9djC_skozCgpQUM3YzHtHW6fC2WrWYdf6nv_09PYIbPd9YUZiE8iMnmp5VppRO-B_fI7fB2G-bA5XQ2KvZWgSG5hZnW41V9ldePtEI3oRuZc8-qITf6SxwYMbb5sgE6fW9sLyC7DK8Cn48bWtJz8teHt0hl8Ilk3fBonAN8VLDRQhLVa0xVrZoCtPgQP0juKyKJ3sgFB_Sjn_SDbVjUBmSI_wWFzuM_GIbPiUBnmJBA_VMR6t9OZjNCHPNmPlK1eKUivaoxP8m3IEidGBlnPJd87JW-9rNrY_4TPfC2-P1TGUYgsBywpG6keok-CkIPkRpkADVkKgX5dvtBSifZiOqPysZST3Vw8MW44ZbgkvB3-2q5JGm7OjCDpPMDSr_uh_p_wtmF7iWUjmaMfLPkEUICQ76bcYowvuja0wbyBYlO0fkkWmWknb2hu9IRT6fplDFAPj83dWbWAVqXA9-cpiJVNRLFPLE-uSsAPH_AaX6j4b9sSCgcqZ7o25bYkQd8xIK0rP10snYlfyXQmtNK3gkRyQdhI3jezaLOvKOSGgbkjkWgZPMg5gMnpCQUFMV85KHOL6uA-IIFx34dltZG0JLR2wI_mzXqfm-GJKI2k-adETt1GNnRnJZd8LXWtjskDuSOV9ckYtyXFOmtQ2yJZVEv5LURoLkAlwatwKrp66OrC2VS3565rWoshN0fF0MEVUnXtBuKL-dpjv1By9z_X-jFW9aaXfbNCRQGfZv3c5OTXKXACWSJzBOm49f7OkUKDEEd3NV7by1R5w6wQ9_HzjaJjdHOThYFodBz_MLilCIfNpgTyyxknpcG2UhwhoeCd1CAYrj3cc_2kiAUKNzfzduhKgJZ7wQbOTfvpf3AeYHxkeiFC8dR2gsoxnPclXSjOFTHiy1FoJFRwDfO-02tamwmaa7MoAxsiEcP9xyCRHp_-dGYQgojINVrPnHU07nWtTvWQ9v8SpREe2tWZGK99G5VYECBW8qXvsZ_M52hkgNBMlhjaN80_0FTyKPWILWkzAOZssR9ID8MdBSGsTwTDbQd-wNaWlmA0eNMgmSywZhDdTrvgDGf60-MaeHIqAv84l6oPit3_-ss2WgVOeWEIEG3Nt9F1CJUzVVtiMB9I6qM3GDpSAdEbS2LSSN2TrUJel3xiMxW5NQqNQ8CX4LWcBEq07JR9P4DTZfAbzZryPSLH7eMRoOU129wQPNINOkys4dxDXo3gnUteOc7ic5RIm47gON1u5l4BlJc0e8XmxNN4mw88476PexoLgpSLlwuCIFYqqacJ_IQaw1DsKmrlF425rdQ0e8o8r4iYYifgySN7RjvaUh_RsuDvIV97SwcEqNMOj9_YEzhan3eioQb3mC6_3Hfe8N07OpaxwIxJBHV_8nbrYC9c7F-NLw0OERIWr5rl-Hjxfi1k3_HXkIqAf9faW-UR3vdTKpMs7R5U80Blio7-Z2omm8pIMWLWCez5-fxqLfzFsq47exxbEbbLRth_4aPM5Xp4UGKLx_uw-qMdIoHrYIfxU6MgOZRqSZVXQx06yQGuwXG8N_J4zRvNdmMwvbatZ08ydzQ0Vq282N1K_AVAzftUeMIfJHqzSIShj9wA8gtvFUwVCa7AdOKKra7sFb-EdNfWxZ0mcChSXQYPFxGlcIQqyPOdNhgR5UaVrxnps4F-UK56mzIxbm-m3mLRiG_6fygXGKALCbB08ew4rH0&cid=CAASFeRoEGe8K1RQ6TFgzyWuSHnGHaLyfw&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:22:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 351
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:22:10 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame 0055 22 KB
8 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:23:58 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame ABED 111 KB
38 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 19:28:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Jun 2021 19:28:17 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame ABED 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BRUIMjdsG6O0b3R7jdD_qnJohNERFOz9eLUNW5oWJ62nfkLxVmVjN-lUB-x4xJc_IcptwvUZTOOgqniFoTORS7Dbk-o4rE8kYIAaIh03dwFfv-0NLO5o7iVQf9DH9Slcy4OGpWydPpOfLZuC-ZFIH3Wzx82A&dbm_d=AKAmf-CxTYI3GuNQbuhi-Ha6Pudb709-q_-T13wvTuyHaaX3EXi8yFbNt5UnV0v9Ebd3_dD0T2ebVOJtmPQNs7GSo4p65GY2tckogW85f56Wcm8h2PkvhYCkBDkP8gm_McvA_s33aT7djJ71fGu0GMaPLk3DmzlemZSZLdPNT5Utq7N4bJXqGFx0e_TvRulJD3MEjtFzdbSakJrcwUO1oyL-4798-rdmbZAsKfJXK0sH-hHFnB2_q103llsXyr03fn64dsjqGd_wqx_nCriP4T6T0sZhlkxvcEjC8IRMtNcV9ZO-NZgOjiw9nrnXHweW1y_GqqLup9uYCrxlHFa2rLguvQgvGGYsg_EjzFP-OrNIaZL-NyJIZcc2lIvJ2cMTKpP-chGoNdvuUy164vRbjTpzfBBAZAnTYZPqQrsAzt5MI2MoTsoysUTUawlIpJBPFN3pO6gehADgLrbFo6z6PjsOEonh1RiMqOECnJUCQ8Cx_6nyHi0x_4cSGNlt-2611NeLRocIBeOFrmM3MzRWntm4ZgTSbAd4SHVtKKjG4LwzlGWIIfsQugLHOCJIvaWnhmKPixSSqIWtJxvv9HAxYTyvOHNwDJbQzrwF66Gvj1zgqPJd4P28jaAHZgYAlFnxmLO_74IEL0zKLARKmhKpvMvPx6Ag_J5hVFkvqnpaA9vUefmFBH1eC6zlrXVRMcAEahTI88-ipleJGIG0vTWWsEiX7lT4hQt5QFbcl2ACbER2qjwU4Dhl5XJTB7LNp48mOptMpKwJ8cmxwybN48POjjSZSfP_c0xCz5v-3LIz2Qq-R0jNRVLtRxt-ehXiIiZ4IdE_-C23k2YKWfOLaHAdUAIBWqyIHVSlr9-o7qZg7CsoabBb4xXtBYIvRKeZ9XeKueugKVDMESebq0OmY6918MU07kZmWJPWZPuW60STEx8Rl3DopOj-AySIAnJcCZJcaJg5pNzkx5kOk_1wg7lqcAv-vte4e82hb_Erh4V2Fo3097RspRH_QYPTLJ1vmdkUb5Qcl9AaOWYm1my33rguxV4fm-xqfMxJEDzqWi1FYkEcHJg-liPxo3tjbR3XVRsyKa2RypK23vhlqrfBTTDGhc91dZzOI1OolSjWxTaAZrM1xlNEM-AoGDFC2-xQtfR98GUWCvkTnfGrnnQdWm7frChYqys59ciEyDvvhSojLPlk910GzeFzuTWtuGVYBruZyLVNiCPDXP8LWrfXveJWeTlfGRmMJ6rb_wZloMfFKbs9j8ljbZy7mJ0aEpKdrlDBgo2BcECPEa8XNLHK0ntzXK0b8JgQOIawT1u84z9VuW4_RhIOhkanwrK8cO_KHM7H2fuX_cDQzVJ3gu-Am2cu9eGaTcfesMpchuUdy8Ct5jJ8l5gnOd872FvytQa6w_kMHy2iH9IZ9kZu_ZDwwYhxpn71cs5vpI_6IwFVPz28tURXe5n13-v72SZKfZJqfRko7pc9uq5Oj1otui8qN5vyE2fbiPrlPxO1Qt7sy5rT5ixcvxy4lcXxBrD_U7FEDcDrt5EV-TlbwLZpYrs0PXwLTZLNYuN4F7y5tvwz9klQjL0VvLZfIhG8c8JJz-RHO1himqnP3_BgkcCuoxWUAo-nFgof4QasMbI8WteEs7lag2V_yuSPOv4n2ChOCIQn22XqH7iHb1doV8fzTa3k1FDCM4L9XttnH5FSGK-nb6xhkJRn9yX1LrQSZvaJXkVahb6cgnzZG7TvDGQT6q7w2xc3wj-p54lO0lsXihA1mNO8ZhxyBZ_w5WlcRKwgGllglTs_P6uj4U2vsLP2idQznf7Vsci4W_G5kK5QFW2l1kBmkVAP6sU3PE7LQI-IQuLBo5n2lSkXSPkwS7mxJo7Wj3FEzDiIGX4db16PNL08hbGvRtcfH5AFquHW2GSo8kRBW0J9AP-6ng0KuPtHCkNFFWdPkd6RoAx3xu3a6f1OQcjTXoaF9qLFeccJv9Z0QXD7GQOjHELFRJQ2HvE5r9Jq-jzHGVo8y8IHZVfKFP-BayHGxHffkLlTY4AO3nZSKA-yKvzIXJDtQKExGZ_u8dbagn8iXWiqYzeb6fjmMN4YssTxKutt5mty4DjiUXpo6dLQ75XjgZpZJv9pQyD29_H0bZkH9EE5ccGBVnLyTk3IZ4TbZraCny-YR0Eg6dlTM-2lOIH8k38BjNJJMIpyMzayKGiuSaKwEkj4TUbIvetkEB1q95rAcZ9pkZstT5FHNTYW-RwbqgYb_Jyjl6rgbPEwOjm5VHxXbTsaM0UDpY_XljdCCbcPcRGu3mJagtxhvfs9iuBsiSZhplkbgd8hNE0jPiSw8gP1OGlWP715OYgxAOm7vL4XfkPFxusInzTp1TC1lMg_veG2pkoB-LBzUbE2mPwktgD7acyJfAE_D1cTaefoUEgi-XbTble_mIG7KPw3BZOF5fz6JSkzw8WaqvuTNpFdcGb2wA7GMhJ1fEXwJe1Gbj6rhKlmXKU7cjs8YVRejFo2c7yn4dmcF0lzPBz8XSIfKaOrP9LVCSBITK5dW7YhS4WBko79GeZ9l4ub3z-7iexJ23CnavCGCoVie6KMZkfbwiv56tnoMNXIuVjeM_pl4-aTQbsDLtM3WG55e_HzVQdnBavaiUZb00BgL2ZE7tiGLzivhVJjtp3eGQkeCoZNw0AKMVizeSSTFjBBpqpCFz3cE0TQjRVTY73StUTlr9R916DBUcdeJXmLLSkbd1zF1cbh8GwuQr_yU74PKCYQDLTkBp_vE6MvepYTNmEdBz7YxlSH87rKOaj9AIZ7SY0Ql2NsodhnusWXxn4gr4KYXFobulj5qkvQ6oqvoJUI1auoGgz5BTvI4KYwzd4Go05DobfiuDMcloi4eGs6hhrrLzHuSl8aVc42BsbTkHIx_01jOINx3xE5pW83Us_2zsfBwwaU-_JmooHnWZlDxexa10zjsPDNmL0Fj1MQbi64_mfCgKjqFuSVhFrYO8b21cw_i_qv0RdGOEECSxs2ywa-z0mEBjtnVeNGnbyf_sL-is7okWo3IQ1SabRcG7qiUQTfL3shbBusHmH5GeaZKTzPYxKNmhOyL_5fnD7CeASquTCudJl3LHAJ6SiIwUKj2UyjGx1-bjocXimEmyo&cid=CAASFeRoF4JW4g6uqfplRRnnGAjTzYtJ0g&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:22:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 351
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:22:10 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame ABED 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 07:23:58 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5CDB 22 KB
8 KB 8ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Wed, 09 Jun 2021 06:20:54 GMT
expires: Thu, 09 Jun 2022 06:20:54 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 4027
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0055 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:19:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4120
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Jun 2022 06:19:21 GMT

GET
DATA 200
OK truncated
/ Frame 0055 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69fbe41bebb4761f84b5d266a42d370a4186d4f3566976f3e33636f35f94951b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame CA86 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2140f863d32a3878c3599baa3f9f8ac978f5c59441226f56506dddb0209d5311

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame CA86 0
60 B 42ms
42ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 07:28:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame ABED 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:19:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4120
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Jun 2022 06:19:21 GMT

GET
DATA 200
OK truncated
/ Frame ABED 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6964f7d7ebb15cd4f7639ccf358dbfd136d69d8a0c959f1daf2bfcbc7eaf761f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F40F 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Wed, 09 Jun 2021 06:20:54 GMT
expires: Thu, 09 Jun 2022 06:20:54 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 4027
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 moatad.js Show response
z.moatads.com/havasfrorangedcmdisplay758646212611/ Frame 0055 312 KB
105 KB 151ms
84ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: dffdd9b6e2957c7e83d586fe8f76e2dafa3855acfdb1cda8c9098074f5127c2a

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 09:53:51 GMT
server: AmazonS3
x-amz-request-id: XWQA1AWR0YK4S090
etag: "42d45703fd6788947b8ec6e1fd17e452"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=62202
accept-ranges: bytes
content-length: 107119
x-amz-id-2: xymgVLblmGQVc7LW07jZ7Y7XknYVi3OhPKxVh0b1lJqZAa8ykh9WEqYQAOo2vRW+6q05IN/GJ1g=

GET
H3-29 200 index.html Show response
s0.2mdn.net/8364571/1622764172320/ Frame 28E9 6 KB
2 KB 20ms
6ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764172320/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55f5c456b1dd90b093056c3d0038cb4e1c3c215739f46b771c11eb93cfeb518f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8364571/1622764172320/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2288
date: Tue, 08 Jun 2021 22:11:20 GMT
expires: Wed, 09 Jun 2021 22:11:20 GMT
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 33401
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0055 0
24 B 87ms
49ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuTiKh8Mzu-bciDd8qt866KqVuELWETgF9mVuCerfODUePHtLBQIJxik1DvvmPm7K1fm6QolFov8SICtu_Y7STcFliKEDglT2H3IArdzeYp1hkq7Ex1ZfaUzpztPMSl1r22DCduY8G5gEyRZjXwYY9Z355Xyyl9RPliHCbRcCxursLur_SuxMaspAgnRMhLuPXEKfnc-9VEqWlFUX-gQiNahihIUEUm6s5J1GeNEFn0yZFZKX5rh931ztz1Ca2eklIPLu_2PdTPz0ZEut-CS1kDVEu2tZjWEiNsajtbEmierm355ZEf-Dg0GHYKJTaEqeugag0rg_XIwG2uEerrYNg7RYV1lNunJjkgJdKRUaqfn-Ezh4RuMnaXc37VwtJAigeH_d1HoD2ZUI12Xn8b75sMqZzzePfk0YDbPju9H3fGaDNBP8TEJwlJ97w6xKLpakgP6C7_50LIEcMsJUuhFV9JhDq4ds6GSI1VRHDf2-_UPlc_2bsclF33H8XTSTJeTlBYpXnHZseRrgtUyHMFZjJKql_ZyIbhfqPkC1DGsZXTiFha_2gDxk1UdnZTYBmLKLI7PFXColja6sZ5LVe7og27Gi2APvXrjgRU0cDUiw8JPT2mS1jFrJ5E66ym8yij3nZTkPp-PeeHGkaOtMht8ZksUZN56Vs4DSGFSu_gtBtcZ9YWQrrPQjGeicq869hhtf8apoi_GCe-hry6C5bD5yqIKQDS8Ex9QrKYOkPI8kCkq84r4JNR0uxuC8ytl24XzyF93oY1EWCw8rOo7hzFbQoJRj-K3t6jtDHhyiY1b-9RAcGsEvCcWXt--QX2zo1Qfkhd4a115SBUu1S9oumGgBOCJh4al-2Y_O7fapPHC0WAo26kVzBDmXd-zpi8Y8wv0feI1zzExRuOrJx7wTc5keumMgyf6hUWRNgVwK5yUcFhRUB1D4hUIWM6Zfp0QXkJqIC-Zen058Llq3ARaW-n0I14Zp-1l_q4SnYZ1Uc2rQQWXx2kBRtkDL2z-vWBiauuh6-V2irFmIQoLmsytm5UT_xxcGb8yQmTwoJnd7K_fzTsaoYTew9PDlf_N0792naMl1bto8dZsW1XrOBdmviflPdRC1Oqxn5oPvWxlUKre9BjtlwLGL61MtnMTlp09Q9M_9CV2jg3MRinXAFHqobueILwOnR351ELYmPcfeBi&sai=AMfl-YSXOrJMAKPK-ETQW6gETmK0Octsjlx4Eics2a6AdFgThy_kWdeiZXoQrd6HZUhNXfaa3j7uQ0BZaBGDTTbRMqAA2g-A1HiA-PsPK7ZMdpzYb_G4SoH4LWM6nrJlIV1bes1MFMTyHLg-cmnJ_cY_bjhQqlPDn5pXgC3DfoA&sig=Cg0ArKJSzOdwag4lkLAoEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=128&cbvp=1&cstd=126&cisv=r20210607.67186&adurl=

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Jun 2021 07:28:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 moatad.js Show response
z.moatads.com/havasfrorangedcmdisplay758646212611/ Frame ABED 312 KB
105 KB 202ms
140ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: dffdd9b6e2957c7e83d586fe8f76e2dafa3855acfdb1cda8c9098074f5127c2a

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:01 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 09:53:51 GMT
server: AmazonS3
x-amz-request-id: XWQA1AWR0YK4S090
etag: "42d45703fd6788947b8ec6e1fd17e452"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=62202
accept-ranges: bytes
content-length: 107119
x-amz-id-2: xymgVLblmGQVc7LW07jZ7Y7XknYVi3OhPKxVh0b1lJqZAa8ykh9WEqYQAOo2vRW+6q05IN/GJ1g=

GET
H3-29 200 index.html Show response
s0.2mdn.net/8364571/1622764172320/ Frame A8C6 6 KB
2 KB 15ms
7ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764172320/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55f5c456b1dd90b093056c3d0038cb4e1c3c215739f46b771c11eb93cfeb518f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8364571/1622764172320/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2288
date: Tue, 08 Jun 2021 22:11:20 GMT
expires: Wed, 09 Jun 2021 22:11:20 GMT
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 33401
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame ABED 0
24 B 81ms
49ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuSHaRkMrMdbR9hTTVf_xgdkiXquDvMH02kMYmGEfmE17II42bmeSeSwDblGCio-cfVWGSr1i3yCpxjpL98UnB-OFfJwbG4P303IuTSBLzLIixn3f7Eaz7dS-RmpOdKyT_yGZ18WMbHgYfbS4XeZFsawpmWx6Vw9abHgUlqhCheEHo9-2HU-pL20_faMLusae6uwVpXbRPrJeLisD8hggC7KzJX_k8TBuITZ8N25ch3pDyf4eafLtLdMG7MteuYk3D5r12Cxl-1gOH16-42N7xozjvQo9mPXZmWvIX2jpTNPpqxEYybeWDQhuDUhu6ve1PoWwrqJ7zypo9jvk4xX6T8qJ11Hg-f7wLANhP59rTIZ2AU4IzzATYPEDC5MqVibVIFar8E1et4ZbP5_4QMqZgS2_SxDuaLojWUhIXTrpxzVottrtEuwzFo86aovG_xIpsP3hm75pDiF3sQhk2qogJ8u1_L9GipuB9wMe4PvlEfUMCcGK8P1Ya0pOp82LYQ75QODECqyFBDtzqKR9DpL4HzGJoL6Bz1gc8owOgnJtMfrmIhJSh8ZCThM1_ZlWfTfYQgf6NcMCGasB1P2FRpqZ8c9hRmKmFpQ--f_yasTNx7COezZitSS8tBXtyJzDKilAxeJZmASfKgrCNDzl_BA-_8EsdV65Sbv5Go9GyKJnPLjUTZv7YWhCnb-rVc-FXodj05ArmAshJcindZfHdiG4G4LZNfXOlCQdroVMHDmh854SYzysIct2j3U7xs3OghhXOFIHEKH1SQzUG0f8Fb99uEwLQy4nbz01HmFEynZ3Z-sjSqduZS7CS9s7ZKmu1JIzTr1SytOLR0vc2jdteE8qquNESf25vaQO08LY2pSjkENcGTtTbUGcm0qFxSU4gPVP7EXCv6WpJd4Ji41aTgmQbgSFsUWdbVCbnOaKTRlXdf-8KnpZvmiLVtXIOwrjau3UEgUntbvGOvI9Qf7tkUJLtcNo0gVhCQRjNtExDZ481wCJsBe2tPo81-Hh7MJJh3aKLICLKYOK42DD2aJYUuUnnrjQ-XdV43jR_WCw1ptqjyPCGM-siZX_pwRnRvuH1CGwNRIc2THnHVTmg_ibg7GVf4EkJtRBNtJ1Nbs-ORlQWzdKEgFyIJbKy6ocsFmKGSQQC_nMYg1NxicA_P8tK3aVX32pc2&sai=AMfl-YR8Pt5oQPdD1qjmFCpTo8e_Iw7AFoveTJPvTgpFGzHdi_B-guezaJ_Rp5Z9djxOS1fBzlpumWLLZjspQ6lEGSRmcUSLeAj7h1vQKUWAQEWEmVQJLrB5Uh2Ea5jJrr9DnRDsuF7DqNL6cOE1YGXCg2K5fWCAgg84R7wGevA&sig=Cg0ArKJSzJVmZ75b2yYEEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=116&cbvp=1&cstd=114&cisv=r20210607.95427&adurl=

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Jun 2021 07:28:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 339F 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Wed, 09 Jun 2021 06:20:54 GMT
expires: Thu, 09 Jun 2022 06:20:54 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 4027
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 1FF9 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 581
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 07:18:20 GMT

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5CDB 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 581
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 07:18:20 GMT

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame F40F 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 581
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 07:18:20 GMT

GET
H3-29 200 styles.min.css
s0.2mdn.net/8364571/1622764172320/ Frame 28E9 3 KB
1 KB 6ms
6ms Stylesheet
text/css 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764172320/styles.min.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da7ced2b7cf67c6b5c66c667ac8c7efb3da1bbf4a9f7ecf650cea3d55d163121

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33401
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1232
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbe54e94c5b7013be13d29aa3d18b209703b006b02f675d38fadce9a06ef44b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:04:48 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 4993
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1662
x-xss-protection: 0
expires: Thu, 10 Jun 2021 06:04:48 GMT

GET
H3-29 200 visu.jpg
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 9 KB
9 KB 12ms
11ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/visu.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0311760f0d1d7104ee1e26fe688d99318207eefcf9bd901b24b4842ea08d2e81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:04:48 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 4993
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9343
x-xss-protection: 0
expires: Thu, 10 Jun 2021 06:04:48 GMT

GET
H3-29 200 txt1.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 2 KB
2 KB 13ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad589d689a7bb947aab88606e22ab5e223c7cc6262781d26840898a3da6d6096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2334
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt2.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 892 B
914 B 13ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a302210fafdcae6e8ad035d4f12a396948612e53eab149cbbb3e86858b914953

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 892
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt3.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 718 B
740 B 12ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

645807892c53b8da7f8ee98d755267dca01eee2a9d10b18dbefad2f1d869f4d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 718
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt4.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 911 B
933 B 12ms
10ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8861ca3c8de0fbf534db9d5218dee2895e991e3cdfb396eabcd200162ac194e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 911
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt5.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 682 B
704 B 12ms
10ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dfcbe450ffb61b43f20eac98b57164f1d28f5519b45bbb99a9ca3ccb0030ffd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:04:48 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 4993
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 682
x-xss-protection: 0
expires: Thu, 10 Jun 2021 06:04:48 GMT

GET
H3-29 200 check.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 175 B
197 B 11ms
10ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/check.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d5a9b603cdc42c9fecaa13301e0af4cd00803755708e0a58ff998ce3f75d65e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 175
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 check1.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 196 B
218 B 11ms
9ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/check1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc7d4db12f115339842bd32cd4327c1176365f2136eba7df34044529efab275

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 check2.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 175 B
197 B 10ms
9ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/check2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66a3fc4c166626833eb88597fb17f81f3f94b2995c2631494de294415cb9ab91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 175
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt7.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 2 KB
2 KB 9ms
8ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt7.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab2a134e9fcff8f73af73e9d73cfaa4320c9d95468d38c83de32b5998b61b2e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1890
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt6.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 3 KB
3 KB 57ms
56ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98c3eb2632fb2bf652e8b8261ab8318d0ee734e63ebf683058a1aa8a7605fa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 footer.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 898 B
920 B 57ms
56ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/footer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0afee9df7632b69ff33bb7d15bce371a8303a7b48fa9932dfa88c989c729c199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 898
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 picto.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 603 B
625 B 15ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/picto.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51cd3d6b06ac11ab0948a2ce832bf2b6101bfc47562bdc7fa0969933c158418d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 603
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 ml.png
s0.2mdn.net/8364571/1622764172320/img/ Frame 28E9 6 KB
6 KB 14ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/ml.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a19fba993bd6523faaa367f3e354109922a04b2e6ef5d2f33d3da2ae0c695017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33400
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6538
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:21 GMT

GET
H3-29 200 scripts.min.js Show response
s0.2mdn.net/8364571/1622764172320/ Frame 28E9 72 KB
27 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764172320/scripts.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8d235f0f68d40d68729ce58b8f6638ab4a30c78f54fbe11d8859c7750d25299

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33401
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27733
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 styles.min.css
s0.2mdn.net/8364571/1622764172320/ Frame A8C6 3 KB
1 KB 7ms
6ms Stylesheet
text/css 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764172320/styles.min.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da7ced2b7cf67c6b5c66c667ac8c7efb3da1bbf4a9f7ecf650cea3d55d163121

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33401
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1232
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbe54e94c5b7013be13d29aa3d18b209703b006b02f675d38fadce9a06ef44b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:04:48 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 4993
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1662
x-xss-protection: 0
expires: Thu, 10 Jun 2021 06:04:48 GMT

GET
H3-29 200 visu.jpg
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 9 KB
9 KB 13ms
12ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/visu.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0311760f0d1d7104ee1e26fe688d99318207eefcf9bd901b24b4842ea08d2e81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:04:48 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 4993
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9343
x-xss-protection: 0
expires: Thu, 10 Jun 2021 06:04:48 GMT

GET
H3-29 200 txt1.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 2 KB
2 KB 13ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad589d689a7bb947aab88606e22ab5e223c7cc6262781d26840898a3da6d6096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2334
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt2.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 892 B
914 B 13ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a302210fafdcae6e8ad035d4f12a396948612e53eab149cbbb3e86858b914953

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 892
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt3.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 718 B
740 B 13ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

645807892c53b8da7f8ee98d755267dca01eee2a9d10b18dbefad2f1d869f4d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 718
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt4.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 911 B
933 B 13ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8861ca3c8de0fbf534db9d5218dee2895e991e3cdfb396eabcd200162ac194e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 911
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt5.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 682 B
704 B 13ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dfcbe450ffb61b43f20eac98b57164f1d28f5519b45bbb99a9ca3ccb0030ffd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:04:48 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 4993
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 682
x-xss-protection: 0
expires: Thu, 10 Jun 2021 06:04:48 GMT

GET
H3-29 200 check.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 175 B
197 B 13ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/check.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d5a9b603cdc42c9fecaa13301e0af4cd00803755708e0a58ff998ce3f75d65e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 175
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 check1.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 196 B
218 B 14ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/check1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc7d4db12f115339842bd32cd4327c1176365f2136eba7df34044529efab275

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 check2.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 175 B
197 B 14ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/check2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66a3fc4c166626833eb88597fb17f81f3f94b2995c2631494de294415cb9ab91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 175
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt7.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 2 KB
2 KB 54ms
52ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt7.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab2a134e9fcff8f73af73e9d73cfaa4320c9d95468d38c83de32b5998b61b2e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1890
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 txt6.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 3 KB
3 KB 55ms
54ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/txt6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98c3eb2632fb2bf652e8b8261ab8318d0ee734e63ebf683058a1aa8a7605fa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 footer.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 898 B
920 B 56ms
55ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/footer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0afee9df7632b69ff33bb7d15bce371a8303a7b48fa9932dfa88c989c729c199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 898
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 picto.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 603 B
625 B 55ms
54ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/picto.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51cd3d6b06ac11ab0948a2ce832bf2b6101bfc47562bdc7fa0969933c158418d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33401
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 603
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
H3-29 200 ml.png
s0.2mdn.net/8364571/1622764172320/img/ Frame A8C6 6 KB
6 KB 55ms
54ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764172320/img/ml.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a19fba993bd6523faaa367f3e354109922a04b2e6ef5d2f33d3da2ae0c695017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
age: 33400
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6538
x-xss-protection: 0
expires: Wed, 09 Jun 2021 22:11:21 GMT

GET
H3-29 200 scripts.min.js Show response
s0.2mdn.net/8364571/1622764172320/ Frame A8C6 72 KB
27 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764172320/scripts.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764172320/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8d235f0f68d40d68729ce58b8f6638ab4a30c78f54fbe11d8859c7750d25299

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764172320/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 22:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33401
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27733
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 23:49:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 09 Jun 2021 22:11:20 GMT

GET
DATA 200
OK truncated
/ Frame 28E9 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 643ac89572093a4c907c1af802b3d354453c64d545dc3f1be1ce689046064511

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame A8C6 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 643ac89572093a4c907c1af802b3d354453c64d545dc3f1be1ce689046064511

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 339F 14 KB
6 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 581
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 07:18:20 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame ABED 0
23 B 41ms
41ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0055 0
23 B 40ms
40ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: prnt.sc
URL: https://prnt.sc/14oeka3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 n.js Show response
geo.moatads.com/ Frame 4F63 112 B
287 B 127ms
45ms Script
text/html 52.50.244.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&m=0&ar=905afaa-clean&iw=7038f66&q=2&cb=0&ym=0&cu=1623223682036&ll=2&lm=2&ln=1&r=0&em=0&en=0&d=25987824%3A4440622%3A305217887%3A152152301&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&bo=prnt.sc&bd=prnt.sc&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=havasfrorangedcmdisplay758646212611&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A-%3A-%3A0%3A59&jk=-1&jm=-1&fs=191984&na=774752593&cs=0&callback=DOMlessLLDcallback_73875785
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.244.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-244-146.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 07d747acc38ffe0fcde981691710f919708796deb8c69006374e8081e8263262

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:02 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "7ffb565db70872fded75183bf50b7feada4b4758"
content-length: 112
content-type: text/html; charset=UTF-8

GET
H2 200 v2 Show response
mb.moatads.com/s/ Frame 4F63 133 B
309 B 90ms
31ms Script
text/html 18.132.66.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/s/v2?url=https%3A%2F%2Fprnt.sc%2F&pcode=havasfrorangedcmdisplay758646212611&callback=BrandSafetyNadoscallback_73875785
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.132.66.136 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-132-66-136.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 7f4222b3b234dccaef2d06415e704a427e845776571c5e3662614cecb194e30e

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:02 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "fe277975bf69d06eb5cafc64ea7954f19f4874e7"
content-length: 133
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 32ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&m=0&ar=905afaa-clean&iw=7038f66&q=3&cb=0&ym=0&cu=1623223682036&ll=2&lm=2&ln=1&r=0&em=0&en=0&d=25987824%3A4440622%3A305217887%3A152152301&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&bo=prnt.sc&bd=prnt.sc&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=havasfrorangedcmdisplay758646212611&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A-%3A-%3A0%3A59&jk=-1&jm=-1&fs=191984&na=517263153&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ Frame F72B 112 B
288 B 74ms
44ms Script
text/html 52.50.244.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&m=0&ar=905afaa-clean&iw=7038f66&q=2&cb=0&ym=0&cu=1623223682108&ll=2&lm=2&ln=1&r=0&em=0&en=0&d=25987824%3A4440622%3A305217887%3A152152301&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&bo=prnt.sc&bd=prnt.sc&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=havasfrorangedcmdisplay758646212611&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A-%3A-%3A0%3A62&jk=-1&jm=-1&fs=191984&na=1515168677&cs=0&callback=DOMlessLLDcallback_71479188
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.244.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-244-146.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: f93bec11dd7d09ddefe2bf1c2db5ba28972162eb71ae022e1a968b4fc5af5556

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:02 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "7f61f7c945e794b574c280f8414fb3609b44d773"
content-length: 112
content-type: text/html; charset=UTF-8

GET
H2 200 v2 Show response
mb.moatads.com/s/ Frame F72B 133 B
307 B 42ms
32ms Script
text/html 18.132.66.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/s/v2?url=https%3A%2F%2Fprnt.sc%2F&pcode=havasfrorangedcmdisplay758646212611&callback=BrandSafetyNadoscallback_71479188
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.132.66.136 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-132-66-136.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: e704f83e08e69ddb5a5d422a3f4e46d4b27df95097101d549751a758fe58b7eb

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:02 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "09cf68b5d91afb5cac56600058723a89d9eb2fed"
content-length: 133
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 31ms
31ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&m=0&ar=905afaa-clean&iw=7038f66&q=3&cb=0&ym=0&cu=1623223682108&ll=2&lm=2&ln=1&r=0&em=0&en=0&d=25987824%3A4440622%3A305217887%3A152152301&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&bo=prnt.sc&bd=prnt.sc&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=havasfrorangedcmdisplay758646212611&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A-%3A-%3A0%3A62&jk=-1&jm=-1&fs=191984&na=1026426900&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 30ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8364571%2F1622764172320%2Findex.html&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=53&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&gm=1&io=1&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A-%3A-%3A0%3A59&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=34&cd=0&ah=34&am=0&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=-1&jm=-1&tc=0&fs=191984&na=1306893269&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5CDB 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BU50JgW3AYPzGJNPC7_UPkvKdwAoAAAAAOAHgBAI&bg=!f3ylfDjNAAY6sG-_OrA7ACkAdvg8Wr80X6gKkFVdDpfxqnVxWAPsQi-M7TFwuKKezhxDQC9FWAXVGwIAAAC7UgAAADtoAQeZArRPNHfXwwKPAapTQWbUmVyp_TNu_LhQKVnGuyxJR2KaWH3zl3q0AWoshfHxHUQAXW7XLU08sMa_H3V3FzF_5vViOQ7uBjWQxZh3O-bt0OZqQbJjWdEWBJ99i078M4MyyBQvTk814F1QkTfwP3qFQWHZdNocd19nltQ0D4oXlQi1wbm2XHGVQlU3F43f36r_6IO-db4fDEtiOy6WqlNV4ihGQ3fW743-fLtSsvt1lilJHFgz_kPgsfwdvWkwPRx_Jyvcp2h67_ISogCWQu2QIYnkHVWaPCZOOUJOE6LZZP1UUHyPKnLXHM7icx1oIZkuF7MVt6LuGfFSHVvCUJ-XAUioNgAQNrPnRAwEP1q2W_VFUu8zsR-9ijI9hbBBREr1_Dwz8lj7UTEqiADdXnDOsjp3a030cB4K4xrguBUvtq5hRkYibZLCQEUKao0tFgt4KxDQ81eYisJn2-UBeFCGyh3oU3_sl2WbiPWgJVKJUxr-Uq10aCcc0UEJFJXFJRCqmo7fjPy6lp9AuSTfIJ39nb35unkcJyX6xN-9o0vZjFYwgPtrnFMcpDoX6h2-O15MhcOim1HYz2e7uym9De_gHAiGUpaMi4eb8dyuk2PYliXlweBE6zvfP-9hUwDSXclRhEyt0dXmlcaekLQMK9gfQuTCmX9kRi5L4_JuBUoYN_2l9Y_zN2yx5GNsR_sE35G4vupSD1RRmh2OI9Q-mRIFnn5MzkClU_7RjI8WDBVVgqd6WtDWDYJ5nAeC8rbgvKRmiqLfKHU9rQItoRm58KTNoU4KZHaOJRo_1K3rtN5-NENid2LaWhhjgMSDOubDhI5NaD-CoRqCcx8kMVFu0pNuCbdeMHpTbx9R2858WZuIcmLfZaEM3vSjdZVCguwg2xMJJM_lbJ4SUd9np1vhsSwXf5rlHvNkkQ

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=223&t=2&li=gpt_2021060301&jk=2312351139813102&bg=!4eKl4qbNAAY6sG-_OrA7ACkAdvg8WkQ3T1cR252stQBNnXoVPRg_mbl9H3CCLkqHMYWNGPk6gAx0DgIAAAC4UgAAAH9oAQcKANMcHtU1UGfVh7WpSNEkHcOI05DCAh364QXVD-pFm_V2EusdK9i5Ue13xeP0_YrtofCyT9aaTC8A7fxDovNVi26TA0bCJ0z9UBWPFm2ziR1mveorXBdYupnVSSxRfa3w95mw7p3W8uQCGaVi-WWSbdbd4ByEH2ogVbbI8E29KYMRDHEzxUq77F58bJo9YW8knfPIUDa_K4vlQIUa6fPZDQN7MG79yyZYcNckKDQeyblcj5E-BqsOhDhQO4ARImERFyaAPvYlGSiwt2KgJfCGwSptCZY2mQJj-UXLOf6Sh-GzJt3hX5hoNWgGhxUX3msZAFRfBTD_puIRMRtOSLONkZMg2xqFnh3YWSTCleOTgG_ucjtEQHmTvNofuWCWbjPvIT8T-yVuuTXi1Lorm-tT1KErbNDro5hgbOci0Eq9I2jXlWszNar3qATnvFuv6awT2JjtAbWn-S3rsbogbDjCkYQDJAQKWKxkZ2Px-H0H_ch8ZFmVQEs_P07eY7ft9Tiu0xLfff5X1mAVuH8teuy33UJ6ODokdkhD1vigoIk9eztfdvWAu661eux46HT-MLwWBp9An51h0ZlXcabFeK3woQ4JrWQiiCqMKi1FyY-7e30MqxhMdj51cPWjHeJNryNR7Anx2PcljYZbbZPJK2krt4oaBxyTBhx9n1ua3LXPzZxYSBTFCDfhKGg0izMzAvnOSaKq9NsaIoAl7-ww9lC6pBRQX6h0uVgax3AewH7fDrFZfPvIf-fj3UI5iDYIErD7dQjnjrWDGLpqRkeoxmR2hp7-Av-1r6SvTmpp5m86MSATBo1cI4n6MUWgpm20rTOtykzQ3Zj4YCLsqdqf5JNeo2RZNLLFs1bWYk9gz3W6Gnfhi6inTsd0n6lsyBryQ25Nys6bRb3yOA47gE9AjlNHVEUhbRZwcuqER8yVp65vu39zWf30JPE65d8TZlsofcOs1QyKOJvEGWixYKYpY7Yacj6nFFGnSMjYMgj4yAcnBAFenQF-WQ3alRUMLFVPMRXCUhfBXHCZHSdypGXIXGKZEns_bcf71jxFoukvxPU61ARqvYYaXkVLop4P-y9oYFXTkcVVH2DuSPVv5Og

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F40F 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BVNZTgW3AYO3NJPXV7_UPjPiWqAYAAAAAOAHgBAI&bg=!u7iluPzNAAY6sG-_OrA7ACkAdvg8Wj6aon1kBkUMl6EEFrua0Yp900DGWt1ewGSY23NH_XZk1xHluQIAAAC2UgAAADxoAQeZAwLkV1NQOwHkQaV5H4o9Ec6NyxYq8PmoHqUN38hFYNJmHEPr92t1hi439tXdFa_SKCCCPwnMwkU2jFf9u45smwzDt55wh78qOCL70NbFQ5ku_gOkTQFIcrfJn9xlhs2LXpm6hZtlVamudXYJXOni4wE-pp3Y8_AZEDPmcuEjR8lXNnaoGbuIzXJLl6DvIwuFCXNoDQ5V06T35jvpMRXh17hqDtWV4205pGgnwCBONY9jTBLLnEg-HV1mgICHz3lbipLx768YGsEdd4qzjus3by9TNxh8OdzVAxs_5Mit-zmqmE8FMPtpPGZmpU66L7RozKEp5sDcSbN_moH3uy1P2TmCoTd15-6QiLBhHM1gJKoMKsA0JFghkGWkZYdsRIQVKnLUaFKQPuUzBeH1vOlNyCanmF-64yPUhOBw-tVe86jmjw4KGbn-hSEF8-YyqGNV78Hy9cyX371BGtpFE-GKQRqSzLOj-v7ht2gHW_b78utYE3RjZQJLAZtTWvP8ZLG508ozf961bNAHpS3R3Xn-bXEBvL7MAYiNQfBF7JsezJNNq7MG7NAEQp5Cr6XLjloB9xS44pDuE_JW1P_2qdwm8nKpcMtRfqDcB32vCQOZaKV78qvsTPMXlohQvsfDKXgkO29tFzMIhupdOBjr8mN3k2kLw1S8wdTce4gYTDRA87B0grz-verqR6ky6TVfPCKRXQHj9ebb1ZNK72_6LPV0rTnlpSI_F65EgbO_pm8nP9pgP27QEV3USgR8wa3Or8HhohgYoK3m_RTg_DvZVp_dB-2P5ac2pJW1rIJ8RRnPD8AexePlwl1y5N_8As8WURpH5rRypbwARwxEcSi_uNxRYBgnQtf7xN28BB3v5HUluqbGps05jyfKdSOqYoGR7erSNLpM3ief7gzLdGExAQ8plg3FYHWiz4UgqrFq-RuO1J4gGgueA9TTXdrD0jmBlF8V9ErTt34CXOzLNiqYEbQY5-HtJLqUJ6n9x9_NyPRffyVr1u8nZ9mjlRNJCCLX4gbx4uFatg

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 30ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8364571%2F1622764172320%2Findex.html&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=25&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&gm=1&io=1&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A-%3A-%3A0%3A62&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=18&cd=0&ah=18&am=0&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=-1&jm=-1&tc=0&fs=191984&na=2017351484&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 71ms
64ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=18&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=1&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 64ms
57ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=18&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=bs&os=0&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=2&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 63ms
57ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=34&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=1&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 40ms
34ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=34&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=bs&os=0&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=2&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 339F 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BDm5igW3AYMvSJOyU9u8PlfGwqA4AAAAAOAHgBAI&bg=!Dg2lDUnNAAY6sG-_OrA7ACkAdvg8WkGcdNKlhC71qDmkQJ_3b0rX4zn16ApR0jr_ZkkDD6dfWtAXSwIAAADBUgAAAAloAQeZAwmTGTJ81iyMN2LwTUcggQ1nFuyvtCNJw-P1Ec_nR9mNwEikFKawaoqaYyBe5h98dalSLeJ_Qali_mJe34oNXCwi_O0rhKP8C5BTZoH3g7ifFOty-G8RBG6HmCOt8Q2cI2-sWBFUbmjkuPf_zOzzFRgohhLZePFy54d1pzOgu-8OLaGEeHT15rLeVjoC-JFY8pMckj9kcWKC5goLix55kCo6FNOLupM2n-NTsS_qww3DOlAxgttwxroL7tp4qesDBqYuuf3stM4Ht6bfFC4E3m9vIeZ3eC3QqK-E1T2XrNyv2-iTek4JPaGE6Z-oTDY9S9fXQ4hmwQ22CWQBYoqWJQ2gn2x9V783enwGOjDho2TzR3o5Wmw7o-fRGrBlDLPNHlPvigvkK78NmX53x_40j0VnsPf8mwUv9GLsJrWHL_1ZioCKEqYp70sIvBHhwiHSjjPUiRPyfghDSOT_V6TubV7vXLyc4Mly4IE4fs2Rua7mPAUh7aV0aghRbevGGLCFYX2xHRejdifRRuWW5pnzzBJepYQ_VQxPZ_VwWRjoLw61AuBAU7PGU1J90-CYUUCn9ckX1uBu-i7aRDJFSEMNqw7gAAy_kLaGku6XXZZGAp9wfDFogzTkDz85JuQyAhGwfAWqhrh9eayAdlapY_5TfMJlNKqPOaeR88JzBV63_djFbTygQNIqPswNxYNL0iQSnp43rc1CIxHJ5d4pYplKNzLkUp8JuFA6tX3_4Uy_YExEYtl47fn5sC8xFLjS9IIUgDa4TwQUekwBzTkEBbHhYovZmCmOwol41A6HUN2eeDITE-fwFiF8OIUFbjLN-bhy63-7MdzXpwlpGLCFK6Y6LvnoPFbPPfh0L6cIHrH4iz2VM46ZWJG5dAYzs1XUrm2P2m4O5_Se9n1X-NA4UKpfjfQEoe-lbKfaf458zhX8sQHFs_-s50YRpc-Clfuuf9XqUD4EsMrnqw-B0PWbvjpyrTkTb0ND_i46dmnjUpQLsH-p_kKix_wqzllkW6Pfj96RosySKtH_jcY_pqo

Requested by

Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 41ms
40ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=205&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=139&lg=1&lh=31&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A0%3A59&aa=0&ad=79&cn=0&gk=79&gl=0&ik=79&ic=79&ez=1&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=34&cd=34&ah=34&am=34&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=2&jm=-1&tc=0&fs=191984&na=34764543&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 41ms
40ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=79&fi=1&apd=192&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=3&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 41ms
41ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=79&fi=1&apd=192&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=4&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 41ms
41ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=79&fi=1&apd=192&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=5&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 31ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=203&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=86&lg=1&lh=21&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A0%3A62&aa=0&ad=90&cn=0&gk=90&gl=0&ik=90&ic=90&ez=1&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=18&cd=18&ah=18&am=18&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=2&jm=-1&tc=0&fs=191984&na=951711121&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 32ms
31ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=90&fi=1&apd=198&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=3&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 33ms
32ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=90&fi=1&apd=198&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=4&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 34ms
34ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=90&fi=1&apd=198&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=5&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:02 GMT

GET
H2 200 worker.nude.js Show response
st.prntscr.com/2021/04/08/1538/js/ 3 KB
1 KB 60ms
59ms XHR
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/worker.nude.js
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/js/script.mix.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 07:28:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:30 GMT
server: cloudflare
age: 266
etag: W/"606f23b2-ad9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://prnt.sc
cache-control: max-age=1800
cf-ray: 65c8a40f4a42edb3-CDG
cf-request-id: 0a9144dd8d0000edb36abff000000001
expires: Wed, 09 Jun 2021 07:36:39 GMT

GET
BLOB 200
OK 0de9d9f4-84ab-47c6-9a32-f8d9902eb318
https://prnt.sc/ 3 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://prnt.sc/0de9d9f4-84ab-47c6-9a32-f8d9902eb318
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 2777
Content-Type: text/javascript

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0055 42 B
64 B 30ms
16ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsumRvClHaFSoTWZCo2hvZarVYYjmr0Ce_Nb81VUNCBlh9nViI89pBglKiY4gZt0PbMAvY22V9r-O1uOJ0gmjxnv1VB3wZtsWmb4fUE9gnPidGM19FcPkOY5z89OsQ&sai=AMfl-YQKZN5CVb0hpcUmXKM6Dv3VpxICin0_j8CJCPOWmOsi-fTz1yh-rX_NwzFeD286w1817Di3BsrAsoFYaV-AvVAP4OfSpvKWTtQXLVqUn0d0bRwiX-BxvnBzR62KaS0&sig=Cg0ArKJSzM9Krb8Xx0RZEAE&cid=CAASFeRoEGe8K1RQ6TFgzyWuSHnGHaLyfw&id=lidar2&mcvt=1000&p=1088,315,1178,1043&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210607&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3120184932&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623223681527&dlt=41&rpt=199&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame ABED 42 B
64 B 16ms
16ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvGpCu6EYzdfkObQZiijfNNyPKs0acjzjumQ95TMHAp87MvXNYTWM1KUUa68ihoheb4008DQeC04R7o_P6jPvOrIeZvin4Y9CVqwQCZCmGi5MGhBWbb2Y-MftvDEg&sai=AMfl-YQrSJqxgoMFtP7OkKMpby7mkrxOmPoSId_XCwk6OoHq-ZID1fyfdcu6eHsKqUziFRBKJ-fd-qvVeq1niPexj6ichivaR6bNx87tpYgDeDxEu5TlDvzpw82Ml9fFMK8&sig=Cg0ArKJSzKEqaW-5Jp_gEAE&cid=CAASFeRoF4JW4g6uqfplRRnnGAjTzYtJ0g&id=lidar2&mcvt=1002&p=70,315,160,1043&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20210607&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1432691387&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623223681526&dlt=29&rpt=229&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 265ms
264ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=1211&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=139&lg=1&lh=31&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A1025%3A59&aa=1&ad=1086&cn=79&gn=1&gk=1086&gl=79&ik=1086&ic=1086&ez=1&co=1086&cp=998&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=998&cd=34&ah=998&am=34&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191984&na=1788302218&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 265ms
265ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=998&tet=1086&fi=1&apd=1199&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=6&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 205ms
204ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=1208&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=86&lg=1&lh=21&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A0%3A62&aa=1&ad=1096&cn=90&gn=1&gk=1096&gl=90&ik=1096&ic=1096&ez=1&co=1096&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1003&cd=18&ah=1003&am=18&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191984&na=1656184309&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 205ms
204ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1003&tet=1096&fi=1&apd=1204&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=6&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 34ms
33ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=1212&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=139&lg=1&lh=31&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A1025%3A59&aa=1&ad=1086&cn=1086&gn=1&gk=1086&gl=1086&ik=1086&ic=1086&ez=1&co=1086&cp=998&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=998&cd=998&ah=998&am=998&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191984&na=1542536756&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 31ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=1209&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=86&lg=1&lh=21&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A0%3A62&aa=1&ad=1096&cn=1096&gn=1&gk=1096&gl=1096&ik=1096&ic=1096&ez=1&co=1096&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1003&cd=1003&ah=1003&am=1003&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191984&na=1576750517&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 31ms
31ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=2&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=1213&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=139&lg=1&lh=31&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A1025%3A59&aa=1&ad=1086&cn=1086&gn=1&gk=1086&gl=1086&ik=1086&ic=1086&ez=1&co=1086&cp=998&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=998&cd=998&ah=998&am=998&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191984&na=410853677&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 60ms
60ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=2&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=1210&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=86&lg=1&lh=21&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A0%3A62&aa=1&ad=1096&cn=1096&gn=1&gk=1096&gl=1096&ik=1096&ic=1096&ez=1&co=1096&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1003&cd=1003&ah=1003&am=1003&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191984&na=1722487703&cs=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:03 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:03 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 31ms
31ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=998&tet=2092&fi=1&apd=2205&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=civ&os=1&fi2=1&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=7&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:04 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:04 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 33ms
32ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1003&tet=2102&fi=1&apd=2210&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=civ&os=1&fi2=1&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=7&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
URL: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:04 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:04 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 32ms
31ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=998&tet=4897&fi=1&apd=5010&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=page5&os=1&fi2=1&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=8&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:07 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 244ms
243ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1003&tet=4908&fi=1&apd=5016&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=page5&os=1&fi2=1&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=8&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 112ms
112ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=5223&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=139&lg=1&lh=31&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A1025%3A59&aa=1&ad=5098&cn=1086&gn=1&gk=5098&gl=1086&ik=5098&ic=5098&ez=1&co=1086&cp=998&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5010&cd=998&ah=5010&am=998&xd=00&rf=0&re=1&wb=2&wm=1&wi=1&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=8&jm=-1&tc=0&fs=191984&na=1367057717&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 43ms
42ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=5221&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=86&lg=1&lh=21&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A3764%3A62&aa=1&ad=5108&cn=1096&gn=1&gk=5108&gl=1096&ik=5108&ic=5108&ez=1&co=1096&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5016&cd=1003&ah=5016&am=1003&xd=00&rf=0&re=1&wb=2&wm=1&wi=1&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=8&jm=-1&tc=0&fs=191984&na=1635113124&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 31ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=5424&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=139&lg=1&lh=31&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A1025%3A59&aa=1&ad=5299&cn=5098&gn=1&gk=5299&gl=5098&ik=5299&ic=5299&ez=1&co=1086&cp=998&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5211&cd=5010&ah=5211&am=5010&xd=00&rf=0&re=1&wb=2&wm=1&wi=1&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=8&jm=-1&tc=0&fs=191984&na=994692182&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 31ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=5422&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=86&lg=1&lh=21&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A3764%3A62&aa=1&ad=5310&cn=5108&gn=1&gk=5310&gl=5108&ik=5310&ic=5310&ez=1&co=1096&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5216&cd=5016&ah=5216&am=5016&xd=00&rf=0&re=1&wb=2&wm=1&wi=1&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=8&jm=-1&tc=0&fs=191984&na=1110813203&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:07 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame 4F63 43 B
260 B 32ms
31ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=998&tet=9910&fi=1&apd=10023&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682036&r=951593753871&t=page10&os=1&fi2=1&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=9&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:12 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame F72B 43 B
260 B 31ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1003&tet=9927&fi=1&apd=10035&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=prnt.sc&L1id=25987824&L2id=4440622&L3id=305217887&L4id=152152301&S1id=prnt.sc&S2id=prnt.sc&ord=1623223682108&r=254414827672&t=page10&os=1&fi2=1&div1=1&ait=0&zMoatADV=8364571&url=https%253A%252F%252Fprnt.sc%252F&bedc=1&q=9&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 4F63 43 B
260 B 31ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8364571%2F1622764172320%2Findex.html&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-KDAqFz9Dn5upsGPVCywBEAhKBRM3uwndnCs78ABRGBCPEpDfmAqnEVFZ&sc=1&os=1-Gw%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc%2F&lp=https%3A%2F%2Fprnt.sc&t=1623223682036&de=951593753871&cu=1623223682036&m=10236&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=139&lg=1&lh=31&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A1025%3A59&aa=1&ad=10111&cn=5299&gn=1&gk=10111&gl=5299&ik=10111&ic=10111&ez=1&co=1086&cp=998&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10023&cd=5211&ah=10023&am=5211&xd=00&rf=0&re=1&wb=2&wm=1&wi=1&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=9&jm=-1&tc=0&fs=191984&na=1783040388&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame F72B 43 B
260 B 31ms
30ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8364571%2F1622764172320%2Findex.html&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=3953972715&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!b.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-RK8ZA3PFBj7g4pVV8xztRIWnSYK6kwU2JeJbBer2APsOGgK%2Ftq%2F3Cytr&sc=1&os=1-FA%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fprnt.sc%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fprnt.sc%2F&lp=https%3A%2F%2Fprnt.sc&t=1623223682108&de=254414827672&cu=1623223682108&m=10240&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=86&lg=1&lh=21&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A3764%3A62&aa=1&ad=10128&cn=5310&gn=1&gk=10128&gl=5310&ik=10128&ic=10128&ez=1&co=1096&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10035&cd=5216&ah=10035&am=5216&xd=00&rf=0&re=1&wb=2&wm=1&wi=1&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25987824%3A4440622%3A305217887%3A152152301&bo=prnt.sc&bd=prnt.sc&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364571&zMoatDBMCampID=51970445&zMoatDBMIOID=20749934&zMoatDBMCreaID=361563555&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=9&jm=-1&tc=0&fs=191984&na=467316904&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 09 Jun 2021 07:28:12 GMT

GET
H2 200 dc_oe=ChMIrZK7t4OK8QIV9eq7CB0MvAVlEAAYACDt0cZIQhMI2tz-toOK8QIV9uIRCB2Hsg8S;met=1;&timestamp=1623223692549;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 0055 42 B
515 B 111ms
41ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIrZK7t4OK8QIV9eq7CB0MvAVlEAAYACDt0cZIQhMI2tz-toOK8QIV9uIRCB2Hsg8S;met=1;&timestamp=1623223692549;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 07:28:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

118 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.prnt.sc/	1970-01-19 18:53:43	Name: _gat Value: 1
.prnt.sc/	1970-01-19 18:55:10	Name: _gid Value: GA1.2.449960298.1623223679
.prnt.sc/	1970-01-20 12:24:55	Name: _ga Value: GA1.2.504293180.1623223679

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc(Line 1) Message: TypeError: Cannot read property 'getItem' of null
console-api	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/jQe3NSGojaA.js?_nc_x=Ij3Wp8lg5Kz(Line 56) Message: ErrorUtils caught an error: Minified invariant #11797; Params: 113 [Caught in: Module "VisibilityListener"] Subsequent non-fatal errors won't be logged; see https://fburl.com/debugjs.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ade.googlesyndication.com
ads.ad4game.com
adservice.google.com
adservice.google.de
api.prntscr.com
c.amazon-adsystem.com
cdn.ad4game.com
cm.g.doubleclick.net
connect.facebook.net
d85da4595862226f1faa2876a737bb18.safeframe.googlesyndication.com
dsum-sec.casalemedia.com
geo.moatads.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
havasfrorangedcmdisplay758646212611.s.moatpixel.com
htlb.casalemedia.com
ib.adnxs.com
image.prntscr.com
mb.moatads.com
pagead2.googlesyndication.com
pixel.quantcount.com
platform.twitter.com
prnt.sc
px.moatads.com
quantcast.mgr.consensu.org
rules.quantcount.com
s0.2mdn.net
scontent-frt3-2.xx.fbcdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
st.prntscr.com
static.xx.fbcdn.net
stats.g.doubleclick.net
syndication.twitter.com
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
z.moatads.com
104.23.139.12
104.23.140.12
104.244.42.72
104.26.15.80
142.250.185.130
142.250.186.34
151.139.242.3
172.217.23.98
18.132.66.136
192.207.255.147
2.18.234.21
2.18.235.40
2.21.111.28
2600:9000:211e:bc00:6:44e3:f8c0:93a1
2600:9000:218c:f800:9:46dc:4700:93a1
2606:2800:234:59:254c:406:2366:268c
2620:116:800d:21:36a9:ecb:e518:b308
2a00:1450:4001:802::2002
2a00:1450:4001:808::2002
2a00:1450:4001:813::2001
2a00:1450:4001:827::2002
2a00:1450:4001:827::2003
2a00:1450:4001:827::2004
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:831::2001
2a00:1450:4001:831::2006
2a00:1450:4001:831::200e
2a00:1450:400c:c0a::9d
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
37.252.172.36
52.222.200.121
52.50.244.146
0311760f0d1d7104ee1e26fe688d99318207eefcf9bd901b24b4842ea08d2e81
0394d70a3c02437cebaf5db2dbfb20043d78249aaadb8c2c79ddaf28f94673a3
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
07d747acc38ffe0fcde981691710f919708796deb8c69006374e8081e8263262
0afee9df7632b69ff33bb7d15bce371a8303a7b48fa9932dfa88c989c729c199
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1b185d89e437f1591af8c51d5e6dad41d3666e22a81931ee9df22e2cfdacaddb
1cabd52f434f5c55be949d18a9e443febf2a04296caa511e2c7f4a1693fbbd78
1d8c7ce12428be733a9213b2fecae66db6950a933c276d68bf7c8271829a627d
2140f863d32a3878c3599baa3f9f8ac978f5c59441226f56506dddb0209d5311
265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6
2875a6fc4266fec00a383377cb4530b6407912897b0727e26249d89c6dfe0359
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2dc7d4db12f115339842bd32cd4327c1176365f2136eba7df34044529efab275
2ddef05ee7b0caa6fd9be281a5b4e53ada42bff7814578d748144f2f9181e476
2e73b7a821da967fead7baf9c750f3d2e710275b83151c0dd48d6d8524a6fa8e
2e9edf448f9b356fa2fdf3b814de88d006d82b9a9b758a768fddceb7d022bc48
2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec
33c4d08388d6d96ef7d9686c87b96813db25b70791ae1fc620e7120f49d0aec3
39685db80e880ec9e59c22115c5bcbf76586a95bf618a714d61fc0e5f271fe77
3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820
3b7f5d160b2635aee3f9b25f405468591bb6030ea06833d1a6f0903d3d921d51
3e4822754298eb051c68617cbfaa42f2ed7933919c3c8ef569ed5da3e75dc4d6
40ec0b04019845302a5052b4689b5d3477c9717dca73243e5faf7cf98f3af564
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45b8a13dcb32541a7703dec7eba4c4195cb62ed00029c2ea5a0b61fd16864b55
483cc9a5ece5c92d5a2f1ea6e92e7f8bc29844a6c06bf36c0349d70334685dc7
4974d6b29a9ffda5bdc00cadd30ce8a64b9fb8a33af884cc9006f88f0f23b02a
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d7c4940621049c43edcc6e709582f94de87f1d11a79df960efedd683e780769
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51cd3d6b06ac11ab0948a2ce832bf2b6101bfc47562bdc7fa0969933c158418d
55f5c456b1dd90b093056c3d0038cb4e1c3c215739f46b771c11eb93cfeb518f
571c6ede630ca7f890f557ceff9b88fb2e212f9fc28cde4a460bd097c3f1a5df
5a3a63b2ac124cb9a194ec01ea1f0d3123e4019bf658c6f47a77b4faea84c079
5b6f3806c04b7c91d2ee5cf8f42b31343a9d33ea62ad9d0506cfa1be078477d3
5d5a9b603cdc42c9fecaa13301e0af4cd00803755708e0a58ff998ce3f75d65e
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3
641e03dfeee60c05e0794bace5fc58d2fba409fee529a114459e44cee0d9d069
643ac89572093a4c907c1af802b3d354453c64d545dc3f1be1ce689046064511
645807892c53b8da7f8ee98d755267dca01eee2a9d10b18dbefad2f1d869f4d7
66a3fc4c166626833eb88597fb17f81f3f94b2995c2631494de294415cb9ab91
6964f7d7ebb15cd4f7639ccf358dbfd136d69d8a0c959f1daf2bfcbc7eaf761f
69fbe41bebb4761f84b5d266a42d370a4186d4f3566976f3e33636f35f94951b
733f44e4d42f00e0a8c267d516e9f6939d36f65ceb3bf851998475b9f6650d3f
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
77255842cd0198cc930adf101a6a6388687ad459659b03a1515c0478cfed7f9e
7b67ae2416a166f4238581097d4ce984a69d9662aab12ecc4b2b881c45164e36
7f0c0d5e15ee4b3a06964f2256fc37be30934a62b0e0bf61a00eb0aa47969eb6
7f4222b3b234dccaef2d06415e704a427e845776571c5e3662614cecb194e30e
83817752fb260ff66b3bca1471bb20dbb6a1e6a17174c657efe0912ad161b382
840bc0ba7ae91b102bc97b6204aa92e72611807cdafeaeb2b5260efcc10cb1da
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86a1b8f94f48c4e82d2616d4c581f10a34ff447a2bd95be08714fa0d19ba3f51
88e2b2882d0550a9dad1d3044abc2153c3e2c9df38381076e3190909f77e05c9
8a9731d5f0175ea3f2b19c6344695ee21a2a7e5462ecb0f1da4ef9b47e5c9873
8bfd2fa3b3b5924e3655bcf9f63427e792bd8572b7ed0992373bdb4b21c7cb89
8f3376b9a097bee1c7aef14cf2b85d5211639d06401e3435aceb5fc790d6e525
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964
9c9935e1daafc929a9866a206e769e084cd83f19d436ca22887adc2798408646
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a08178bec59e311f41fce9704d72ad4e969afb4221d8072115fd6ca8fc4ab57b
a093d2047e1a59b7103810b947780e5f94d865915cb923ebcaa7e50f557c2102
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19
a19fba993bd6523faaa367f3e354109922a04b2e6ef5d2f33d3da2ae0c695017
a302210fafdcae6e8ad035d4f12a396948612e53eab149cbbb3e86858b914953
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a841d7afa97a0ba1207b5c0e638104067247b17a9ced39b3d283511a4f5c92d1
ab2a134e9fcff8f73af73e9d73cfaa4320c9d95468d38c83de32b5998b61b2e3
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad589d689a7bb947aab88606e22ab5e223c7cc6262781d26840898a3da6d6096
adf22c5d5e4b62ff7aec8635fa489d8fa664e2c261f14ae89ea43af3d38db622
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af094c3b412db964b50d48f21abe3696480bd90350167a78bf1828a6bf10437d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3408a1b744ce1351e9554b861c45480f39e54c059f3b11f4e77f9f13564ba4f
b6a1120cc303b1c6ee6d548a5b418c2707b59de0c1f13c8ab870ca4e734b6acc
b8d235f0f68d40d68729ce58b8f6638ab4a30c78f54fbe11d8859c7750d25299
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
bca2c1abcf4b76a46306bc7f1a607a459371ccf5e7213aae988c33b4dabb1758
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916
cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046
cb09c3720b53d8651d6f5825cf643e6249aefbe82a1ba1417d230cdb9b36cba6
cbe54e94c5b7013be13d29aa3d18b209703b006b02f675d38fadce9a06ef44b4
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0b3850a417ef733c6acaff02a3311c7ce9a5b7ee55d2cd76d8c7f1f661bcb20
d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5
d91d13fd8f9d253a8213aeee7ebaa7e073683fc600a3d82902c3c669b8ffdee7
da7ced2b7cf67c6b5c66c667ac8c7efb3da1bbf4a9f7ecf650cea3d55d163121
dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
dfcbe450ffb61b43f20eac98b57164f1d28f5519b45bbb99a9ca3ccb0030ffd8
dffdd9b6e2957c7e83d586fe8f76e2dafa3855acfdb1cda8c9098074f5127c2a
e05edf2ae58e3a9f1d2a84d32a8b216fd0aece46f527b58dcbce75255989ea88
e19385108eaa0e234eb43abc71de123268178ddd9350b6d9d655695a023935d2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
e704f83e08e69ddb5a5d422a3f4e46d4b27df95097101d549751a758fe58b7eb
e8861ca3c8de0fbf534db9d5218dee2895e991e3cdfb396eabcd200162ac194e
e926f30958d0c21d088e6a671d3356a3c3fab9cc6220b8e408f19d868a7dc5c8
eb1c22262cae591f58b1b4473386fe51c67ca0094d38a180dd86224a4b6d074c
ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f252f831348291683eba4029829349268decef978095402981152829a189ec9f
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729
f93bec11dd7d09ddefe2bf1c2db5ba28972162eb71ae022e1a968b4fc5af5556
f98c3eb2632fb2bf652e8b8261ab8318d0ee734e63ebf683058a1aa8a7605fa0
fe0b009af4d6be99bb24436d2b2c67706fa3698e059d8df3bfa9f9c8857b42ae

prnt.sc Open in urlscan Pro 104.26.15.80 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

219 Requests

100 %HTTPS

53 %IPv6

22 Domains

41 Subdomains

35 IPs

5 Countries

1827 kBTransfer

5082 kBSize

3 Cookies

12 Outgoing links

Redirected requests

219 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

prnt.sc Open in urlscan Pro
104.26.15.80 Public Scan

Screenshot
Live screenshot

Full Image

219
Requests

100 %
HTTPS

53 %
IPv6

22
Domains

41
Subdomains

35
IPs

5
Countries

1827 kB
Transfer

5082 kB
Size

3
Cookies

219 HTTP transactions
7 data transactions