naslovi.net Open in urlscan Pro
91.222.6.78 Public Scan

bidder.am5.vip.prod.criteo.com

Software

nginx/1.21.3 /

Resource Hash

b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:47 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 39d0f665-5c51-4426-8c1f-6bd424e9f510
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://naslovi.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 50
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 239 B
1 KB 213ms
63ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12398&site_id=48148&zone_id=1101850&size_id=2&rp_schain=1.0,1!NETMARK%20d.o.o.,199411,1,,,&rf=https%3A%2F%2Fnaslovi.net%2F&tk_flint=pbjs_lite_v6.6.0&x_source.tid=b7a04603-dd2d-417c-8779-e3ced18bd1c4&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=div-gpt-ad-1541165237434-0&slots=1&rand=0.8091300429549937
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 4712accb6d3d9affb7ffdef17ec4c3a73ce47d17d2be674a3f5988a6f845b79a

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:47 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://naslovi.net
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 239
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
1 KB 216ms
65ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12398&site_id=48148&zone_id=1101850&size_id=15&rp_schain=1.0,1!NETMARK%20d.o.o.,199411,1,,,&rf=https%3A%2F%2Fnaslovi.net%2F&tk_flint=pbjs_lite_v6.6.0&x_source.tid=18698782-5236-4b61-ac7b-a7ba7d4d94d4&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=div-gpt-ad-1541165167861-0&slots=1&rand=0.4139089541579897
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 3b64598358882d9372d89ab7d7ff9058b78c6e09fd6d37878b5efe4c58e3504b

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:47 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://naslovi.net
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
1 KB 222ms
71ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12398&site_id=48148&zone_id=1101850&size_id=15&rp_schain=1.0,1!NETMARK%20d.o.o.,199411,1,,,&rf=https%3A%2F%2Fnaslovi.net%2F&tk_flint=pbjs_lite_v6.6.0&x_source.tid=8a4e20e9-2b65-4a01-83a3-4e815310ad9a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=div-gpt-ad-1541165106278-0&slots=1&rand=0.40422055203162155
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: d55b8d305d1546c2296076ff7094fdb32a18de32207b7525cca28d67c7cfb488

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:47 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://naslovi.net
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
213 B 630ms
35ms XHR
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.6.0&cb=24573960173

Requested by

Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Jul 2022 12:01:47 GMT
server: Finatra
vary: Origin
access-control-allow-origin: https://naslovi.net
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

POST
H2 204 / Show response
hb.emxdgt.com/ 0
156 B 148ms
56ms XHR
text/plain 52.59.38.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.emxdgt.com/?t=3000&ts=1657022507486&src=pbjs
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.38.241 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-38-241.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://naslovi.net
date: Tue, 05 Jul 2022 12:01:47 GMT
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: security, Content-Type

OPTIONS
H2 200 openrtb
adx.adform.net/adx/ Frame 0
0 171ms
45ms Preflight 37.157.5.142
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.142 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://naslovi.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://naslovi.net
access-control-max-age: 86400
allow: POST,OPTIONS
cache-control: no-cache, no-store, must-revalidate, no-transform
date: Tue, 05 Jul 2022 12:01:47 GMT
expires: -1
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 prebid Show response
mp.4dex.io/ 114 B
596 B 224ms
117ms XHR
application/json 2606:4700::6812:372
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:372 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5efc39ba20a6e0d4b9e00267b3df41db823235473dffb835e47c641ef247546

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

cf-ray: 725ff2b09b4d01f8-ZRH
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:47 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
x-warn: Preparing candidates. No matching rules and/or Bids disallowed and/or Invalid predictions
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://naslovi.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
server: cloudflare
expires: 0

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
173 B 202ms
65ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://naslovi.net
date: Tue, 05 Jul 2022 12:01:47 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST v1
dmx.districtm.io/b/ 0
0

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 94 B
742 B 160ms
74ms XHR
application/json 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_6.6.0
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 4b304213013e685c9ee6f8b2f750b7862f2b494e4f5cb9cb6369c32e5e43de75

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 05 Jul 2022 12:01:47 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://naslovi.net
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
245 B 273ms
131ms XHR
application/json 23.35.229.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:47 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://naslovi.net
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Tue, 05 Jul 2022 12:01:47 GMT

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
77 B 166ms
83ms XHR
application/json 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Jul 2022 12:01:47 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://naslovi.net
access-control-allow-credentials: true
cf-ray: 725ff2b07a9788aa-LHR
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
76 B 161ms
78ms XHR
application/json 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Jul 2022 12:01:47 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://naslovi.net
access-control-allow-credentials: true
cf-ray: 725ff2b07a9a88aa-LHR
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
434 B 160ms
78ms XHR
application/json 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Jul 2022 12:01:47 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://naslovi.net
access-control-allow-credentials: true
cf-ray: 725ff2b07a9c88aa-LHR
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
406 B 167ms
73ms XHR
text/plain 37.157.5.142
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.142 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:47 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://naslovi.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ 0
239 B 183ms
44ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-lupon&gdpr=0
Requested by: Host: naslovi.net
URL: https://naslovi.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Content-Type: image/gif

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
203 B 38ms
36ms XHR
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1274001319&t=pageview&_s=1&dl=https%3A%2F%2Fnaslovi.net%2F&ul=en-us&de=UTF-8&dt=Vesti%20dana%20-%20Naslovi.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=830182209&gjid=425085383&cid=1310452793.1657022508&tid=UA-138577-16&_gid=1447222704.1657022508&_r=1&gtm=2wg6t0MFLVPFR&z=1006557736

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://naslovi.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
23 KB 218ms
86ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:47 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1054804
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: tx23d92f3433d0467b92263-0062a04f91
x-amz-id-2: tx23d92f3433d0467b92263-0062a04f91
last-modified: Tue, 10 May 2022 09:57:31 GMT
server: cloudflare
etag: W/"2430496689c00115831347992a974246"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JpRcsDoysSYIWNNqjWy30DH8Y5zqPCXlJejCfQ9j8JzfEfe%2B5XQ%2BQuNQc9uOFLjlcassogr20Gv7%2FAd9lz4J1KYSogwBmd9XUI%2BDt8sBfaSJUnW0hcGtLVkofWb2JZ%2F0qv1XZ%2Fyxizg3Z87j"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1652176651393042
cf-ray: 725ff2b21fe2baab-MXP
access-control-allow-headers: Authorization

GET
H2 200 adl-d9566a3e.js Show response
tas-rs.toboads.com/js/ 235 B
473 B 70ms
70ms Script
text/javascript 91.209.18.100
HTTPOOL-NET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tas-rs.toboads.com/js/adl-d9566a3e.js?b=1&rq=b03456ab-9784-1742-2ce1-60cc6470255d&vt=3f7eae80-bdcd-4fb1-a72a-48a3fb95270b&isf=false&zn=7a6f1c6b8&tm=0&af=608x0&fv=undefined&nw=0&co=1&vh=1200&vw=1600&asc=1&srf=https%3A%2F%2Fnaslovi.net%2F&loc=eq-srf&rn=67cfea1c-5ab6-73a3-e809-dd89a17e43df&ct=1ed564fe-3722-2f12-a9bf-2c841a660b7f&c=hA_c_0_afc56a64&ah=0&
Requested by: Host:
URL: webpack:///../javascript/src/WindowManager.js?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.209.18.100 , Slovenia, ASN8558 (HTTPOOL-NET-AS, SI),
Reverse DNS: tas.toboads.com
Software: nginx / PHP/7.1.13
Resource Hash: 782943a072069d3c9a8d9ddaefe175778eaedce0aaea6e52a1b0249db00d3fa4

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:47 GMT
last-modified: Tue, 05 Jul 2022 12:01:47 GMT
server: nginx
x-powered-by: PHP/7.1.13
p3p: policyref="/w3c/p3p.xml", CP="httpool"
cache-control: private, max-age: 0
content-type: text/javascript; charset=utf-8
expires: Tue, 05 Jul 2022 11:01:47 GMT

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
792 B 141ms
49ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=naslovi.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jul 2022 12:01:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 139ms
50ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=naslovi.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jul 2022 12:01:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
18 KB 735ms
650ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2227109324011451&correlator=4356407052268465&eid=31068223%2C31068274%2C31064225%2C42531605%2C31061690%2C31062930&output=ldjh&gdfp_req=1&vrg=2022062701&ptt=17&impl=fifs&iu_parts=33583722%2Cd_naslovi_homepage_300x250_right_top%2Cd_naslovi_homepage_728x90_top%2Cd_naslovi_homepage_300x250_right_bottom&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=300x250%2C980x90%7C728x90%2C300x250&ifi=1&adks=2973301163%2C1402964911%2C150267862&sfv=1-0-38&ecs=20220705&fsapi=false&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1657022508134&lmt=1657022508&dlt=1657022507175&idt=460&biw=1600&bih=1200&adxs=976%2C314%2C976&adys=167%2C152%2C1425&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fnaslovi.net%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=336x1898%7C1016x0%7C336x1898&msz=300x-1%7C980x0%7C300x-1&fws=0%2C0%2C0&ohw=0%2C0%2C0&ga_vid=1310452793.1657022508&ga_sid=1657022508&ga_hid=1274001319&ga_fc=true&btvi=0%7C0%7C1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

a2151efbc2d35673f14cba724c8f572da17af89f56c405c75c22c9f9aa19293d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17932
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://naslovi.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 142ms
53ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022062701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32a1310886c957059d51d0ac31a703dbeaf35a769d3c3f724a999a5ecae5be87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jul 2022 12:01:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10528
x-xss-protection: 0

GET
H2 200 container.html Show response
9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 80A6 6 KB
4 KB 182ms
49ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:48 GMT
expires: Wed, 05 Jul 2023 12:01:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 149ms
53ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 12:01:48 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame EB76 13 KB
5 KB 125ms
40ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 4623
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 10:44:45 GMT
expires: Wed, 05 Jul 2023 10:44:45 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 091F 783 B
1 KB 139ms
50ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

58643239a3595ab4bddc7d2f836d5c21e6e872d561a18087516ac2f5b97485b5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-reNKbhVxgeKScNA-R5Rkdg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-reNKbhVxgeKScNA-R5Rkdg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:48 GMT
expires: Tue, 05 Jul 2022 12:01:48 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js Show response
pagead2.googlesyndication.com/bg/ Frame EB76 36 KB
14 KB 124ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:28:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5617
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13869
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Jul 2023 10:28:11 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 091F 0
0 152ms
81ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022062701&jk=2227109324011451&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame EB76 0
9 B 40ms
40ms Image
text/plain 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?mIe--g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 container.html Show response
9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame DDF7 6 KB
3 KB 130ms
45ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:48 GMT
expires: Wed, 05 Jul 2023 12:01:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A294 6 KB
3 KB 124ms
43ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:48 GMT
expires: Wed, 05 Jul 2023 12:01:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 718D 6 KB
3 KB 121ms
49ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022062701.js?cb=31068274

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:48 GMT
expires: Wed, 05 Jul 2023 12:01:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H/1.1 200
OK graphql
s333.adxpremium.services/ Frame 0
0 287ms
39ms Preflight 152.228.222.122
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s333.adxpremium.services/graphql
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.228.222.122 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3189334.ip-152-228-222.eu
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://naslovi.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Accept, Authorization, X-Apollo-Tracing, Content-Type, Content-Length, X-PostGraphile-Explain
access-control-allow-methods: HEAD, GET, POST
access-control-allow-origin: *
access-control-expose-headers: X-GraphQL-Event-Stream
content-length: 0
date: Tue, 05 Jul 2022 12:01:49 GMT
x-graphql-event-stream: /graphql/stream

POST
H/1.1 200
OK graphql Show response
s333.adxpremium.services/ 84 B
533 B 40ms
39ms XHR
application/json 152.228.222.122
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s333.adxpremium.services/graphql
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.228.222.122 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3189334.ip-152-228-222.eu
Software: /
Resource Hash: 4add193ec222b94a0b99e8a8d6f55f7d255bf7e9a399ddb943ff6ce0d7c9f44d

Request headers

Referer: https://naslovi.net/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 05 Jul 2022 12:01:49 GMT
access-control-allow-methods: HEAD, GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-GraphQL-Event-Stream
x-graphql-event-stream: /graphql/stream
access-control-allow-headers: Origin, X-Requested-With, Accept, Authorization, X-Apollo-Tracing, Content-Type, Content-Length, X-PostGraphile-Explain
content-length: 84

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 690A 624 B
976 B 144ms
53ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIYqozVvQEwAQ&v=APEucNV5I9Nj1mk_PISFVVUvgGDVxrgqlUrh0cj4_RZJCqCOHLf_QdIQ6A__GfbmhhsQCVFDamjHC8lXOL6Yxp5KDjWOyQtcnNiFBe6OcAMfaZ7GkZLRgUe4trjFUAMlRNqlunpGhFH8emiGj2erxVdpnfxZv6dGcVWc1tw0xgF-x1o8VPNQ-AM

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:49 GMT
expires: Tue, 05 Jul 2022 12:01:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A294 78 KB
33 KB 213ms
123ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DcspT7lUO88n3ov4vorUrmQyj2dFdn7vdZK5Xl-jBb6e3p2Z-7IsRpeKzesZqofeCb-ISxLvfHXE903hjb8XNgz2kz76Y0OF2BUf2cSmTl8EI6bcg7N8A0OlsXzJwC7BXnqSDANqEHqOSKj_UJj8IegoXHJg&dbm_d=AKAmf-D59kchE-pQP0CMkV26HCai0kVYVr4UIv5z-WNzuGXTdkOj3GRt3vZ7xTEItlplsRf1rzFv_EvPWQILeJJ-CMfqOtnQJ846UyrroESM3rWogB4MdRgIIRkARoWBH3sniuTG0ag-Ji45CQ6smSBVwcTMjcKtyZ_JLjNtL4FQY_ZhinhuasuWzRFsy36riZCv4M8JwUNyh_cYCQ6U7HVh4gudtF-GnZEPX0ZozkXodGKYWFRi4fLZve43pWnKS1dDY-LyvzNGywBPNkp7Q1e0KfWgoF8b8wwAGjVYVMQwPvoev7feEY7MKToThbTmCbWvdKFDU5Btru3Tyf8-f7vqclZGMontsYobHa3t1BDtvPyve2tzyyFY2kxFW48QeStutyjYYF4P66x6x9YUsHl5u3Cdf8kHUdObVWTqsz-c1EKFY8yBqS7iveYP8sZzK_EC5PolBivOIzudIVSuUOAajU8lvEEPv2-h73k4DLUXRKpQtcLcyeKgKuOJunJjx3ObWOOhgN2SiDmGf5yNotUYh1lQd6poc04QZxdepwmRDQndoKJWMhByXDcFYRF777rEYLoFp1U6ocHgQ9Bp-nUdHC8TCCxFswuKvvANyQdajo7M8mIkSe5YkAj_0NqDhfBRMRVBCvZQEH0FX0XJL1Ga7Q4RIJTU9oEXUK2kFa5Z-DC8X61aXsEjlGIckzxDdKXItwg7G7tGjHRPtPsqMkzePltpmnYa8Vubsl4u7H-E4mzee7sqqs-m2qthOvw9tkNVB0c5necO7NHW1BPVZTmU0qBdeOBE7wrue1sjsVQ1ujg3iT_BNyTfxoBzLagxy89J-x5WtL5XzoaHGOHAn4mJY_88dd4Iipka18GRyiCe3Dnt-RQupBirpZ8ccJGKSMyXEqHk9j9S-PQKQHvPCmf4FRPK83Jb5p5wlIUMPrWLgl4wFhWIba01f_7NagkrGqfD476BGUNLeviO-LEK3kqYjv4GnDXhyXQDJKHvQRxxj1kwKZ7sUjvYVcc0xaFY82CQfH45OIGQJuMwO0fXOwY5bbHSVsKjnl9dYCqtvjB6Q0oMyz47AZ9g7evAnqtgRVE6yV8-x5Cfc1qxaWnI97dPYyudamA-5IWY1LFaTak9zGoRTcxVtb9YSlT58W_SCaDfQ9tXmro4h6jFfZe5aavE8DxD9ozWIBRUUksdVDMJKVrxY3pr6zIMTMWyofYOMiWT3B563NrPCnaqnBDST3R1QboGDIOauOQ55LSn5UVqxST9CKiHz2ofU9hsh4_swwySEsNMQonYBJSXIBLRK39VK5fJd-opiQg71lx5cbzMuo_iDi-Kl3Ke0r2kVigdb6JBnATS8ivZSxuhX-f-4JHUnkp6-JOh3XaM4xQwCWcXaK4HEnEzj0iX1P_gqEeByyu9JKNi7yTWUQ9dNs-rI2zPKuHeYs1ET3ISFAMieethyVflPFkmk1ZEl4K1TtiM09ONDVzPxZxSJbifvDZ1Q6k1pUP_wRY03pFtPdRyPfNmJhEc5bxZixxV2KGfgzUE9Ms9uskilBft1KXlMxVqst1nlqBkgr6yyj35KNswDOW0S7A7hdjZGn5LuSWiA0-Yl_iowxB5VmEAolv4cTJ6wMMwWWzPlHwmzdtjr1PQPSJ5JtgrpVlhyGCX27Yhe_aYxHC3W-v9xzGAJYM6i4tp-qWs0eFmaM64HoJhJbxI7BWO4dzBhh1SFM2EXdYB8KkYOdKt4NrHxUWnPOG6YIJRIwWqx5TojSmGV0BzXBsAwKbUC8HFDUb6S7xtSKbsMNGZX5ubbV2RNbZx5vhmBW1cSX-0NkurT7mlfQ3xo-KHHH61qeDro3DeOM-9xJarpTe4NPPkb-q7lOKTILyWxZMNAidhHjSQnwj3JTFKVEI2KSy-yZY94lGnx_9yRVPPf7wasAYFl6QIZxEBTaIuue2HYYmzawfOdvQgYBgAGuIf7jhs6p0dT_SfN_pPKOv4ReHfiO6gtJeuUCoiEX5mY093G5wTYJcAj8-WoN21omzhCwk2LwQFhEmTjlb2-EEZkOdwfEXNxPw5QZO0x4zBQ3rJWAz94gfmJYP2XsEpUiwx4MUu3Ei3iJE5faP1fcYvvbVdBFLvtfGYOTLG5DN2IqM5A4QoIZS8YRPLy9RlzsjcLDBPC9DQJqyl1XBVxKqjrI-GNKhLvPwvnmYlzUSmbOfkZ2TSibrwXFrhgoYYJE83aXMWirMq_IVBsqU4tGocf19jwOB3uzSQX7siUxWL3IXNKZuvuXdhJao1QZ14qou3dhxlqi0HbqQ-K-RB5G78e5-83FNpzyLclee_YD5EPoRe91uQjM24mH-J5uWQ77sz5kcPOT6G5Yih3lnLB12CJT6WJf5mhnlLeWX2Nr_akE2AMb0jQbU7oS7A1QOcbZwhqwiu305qf8ao7hhCPnCR1gnr22yiM40mXs2xuK_205YeE7MwWAeW_ECcC1Vz-onJ0SI_A9oDNZTVbSQuk7801EQv-n504Ek9OScd6aiD5v6Ogy5xbcsbQUI6ksauymnISBN7yMUi20_0fKSvw-3M13nnmJ4IK2A7Lq3V1UQql5ZdSsD4pEreU9TFprllT4WwS2uIboAmGjLNC9bydQSGNNJLfk0XibbgddfSHh5dry8EizKKnZHDayjuwg1nSJkDbJtO5UfV8SU2DXm9750mEs6-aaZlBKuJKup52xs3YekUte4lCWPHBy9CYmxSdZm-iZS6AKYYYT9Wzgt0uBcimgXLud6OHYrxy8BaHhFtCEzMMMVkKqxhKCMrBHqd7-Lk5KnTvW0haTBhznMJk_LNVyZdwRf72PNfvYSFSTBgBoz3HD8QSKjWzcKRpTPvlekqFjdDuPq1c4nR5Gjt1J3krrQ0HJmbpvVDcHcvpCqHb2nkNlc39BlbomcQZwmq2HzLZkO4XbdKgw3CoM59zEw9IGXvBJLQJxkkocEP-WPkQ_LCmUpndJTVFt_kATIpxCkzBp_POv3CbzToEKoUYDuYkhOTp5L5HDJsGLnuz69uqH3TSHMnsVqdDGEBAPJa-SPW1TDHgl8ioJcTAjR9BaCiJ4kDjwP5hmnGj9nuMr1_BH1ZLe_58KPCZINjb2cjzUeidKSrHsYFu0qj0ywG6PyqMGP3vJnHnhxKQc18aZskL1YaitHT9B47fZ9I8DCKBRFW-biv2CVRBcAgrxhTXjxjafr_sd0ygHGrWtXBvf2T6FdUmW3e9hioVK5NMxFFobTmCeEfRWEC_DwZ8LqFgBeuQI7tCqzWpckXsVWBpu6xT_LANqYdxveueFc7FREyiTppblziD_ruKjiSwDSUguqH9guhlrhDi1ASGLQ2&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&rfl=1%2Chttps%253A%252F%252Fnaslovi.net%252F%240

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

093f76dc02a0578774451b0531c9f645653c23bfcb29aee9a04550fc9526a856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33424
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A294 42 B
63 B 75ms
75ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B6UnvCDA4suE876Tjkfd1LiEnPx3q6OlQVGjAyxgiWMmeiMEU2Pj86j_k354p4XygL57MzoQEjv8hgOd1m_Vqe6e_WQN2Cm4hEn70DEs1PCP8pyuc

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame A294 3 KB
1 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:50:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 675
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:50:34 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A294 138 KB
42 KB 410ms
327ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 12:01:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame A294 17 KB
7 KB 44ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:57:02 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B520 624 B
560 B 135ms
54ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIY44vVvQEwAQ&v=APEucNUpWNME02ecU8e5WGPIFhPipMtfgwK0FJeSaFYCLryj68JpegDbTaOb2LhhTH8RNX6SSTG26sKai-C1HJPYTwX_QgnHbRLZDhLBrrIEg214FH3_srLgWODhuHWH_8bROWVE8UWwajarI8EQgHcJWFoctWqYd1Mk0g5z3aJyZ5n1HxUP7HA

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:49 GMT
expires: Tue, 05 Jul 2022 12:01:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DDF7 78 KB
33 KB 164ms
83ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AFQcSMtmFKDmkVBdaOIilqxr8zZsqBCRiruvATKu3OKypGVHLmcEtBydtNKCkaw1y2ytmHwh93GxN0j3zXrtihL0ZaJzqIYfIlbBUpkRqeot4Um2EQEI-TRFLD2Rqd8Nt6bltzxc7b6cEI5tnkCp3cE7YEnA&dbm_d=AKAmf-CdfkWvI3A_OK_iJW1GTEZfsl_pDBKV_WgXp2pywEKB066lgS_PZxuXdtkAQhggoG_nsM-E3-jMQ_5Ku7FTaxg9mDz1Xt_HuRNx-0_cGmS9ahHSie_sVOatmx0eN66P4Nn47VnEEG903y3leQfhgCwBD01zqpJWmVPvVvQyHhFc5AjRq5FpfRbSOWkqk-GMjQPAdNLJhsys9zPl5lLjzyw8nagdmw6aFRZxWlILHQdpldC9hBc_7uv1YIHyL1I7ui1EN8UZpgshQpozX7NUnIobXT_15WyP3yFpOX5YG63U91j6tDZ3hFnko0-WMwhy6TVupdxYDQbWWotMofiBNLD_DFLg3aKGX4eONds3XhkyovuinOgya8Njmiw8LQSxzJxl8LKgkQscFawdv5uhmngzTDCdasFzRRK7K_2vTMHKEckHu99OsxroaW1kC_iXj_xCD9Iv19kumBkaGrgKorDyal8DvWJ5So-ZcHpVzC9UUK4-Kl_Wg5xV2Zh5rTGWkI0BXadui8cJrBPptFrtlE45XpuR-pj3SSWmA-s27QIpLYf19z-rciiwK-FLZKd5nPH9c-rmMtY_y_8DyHjo0HyjyFgzJ0wNKWzqDxuXyQWqHvKe_3Lk_MFwjoUnHlUJ7G9bkNs9qUBQVS9V7DtXIl3jg1yAbQnkgRhy7iO3Mp39ze4IUT5tMrYzrwuQl2ZhiOGSzP_Eo2R1eesolFiz1pNH0XnyGDBhfEL48mKhdaQxOLs3pCm_syozycjWQ-yfAQTYkXr035GahNq41Gq6ZsIBGbwlI3_6UjUSFiumfc_cKVQWaahj9IKltH6hY4BZD58FkU6KJCYmWslwpzySvPV56555pmMnkYBlFwYEX5CvjQT4RhdXr04589SHqV3TBOhT4ApVZdtVXePQRk-2aE_9xTei8cxkJjcHGBfpxXqssie_IIKqPPe6Yut7OnpHLuTB_Lc_SlQDN5-1k4b_RF6AxDloFLufkINTFP1HRPuhX6PnapX-JoRFoxZHLKhARJzD2dt6qWZF5fnKv4eVivGfGPytI6o1mV6ypHnM3A3xFJrCNhVKjvMOSvvnJ0VkL9OAsLZMOsdNExjL0Urpy4aektgEHkKR0dsxLv-yRxixh0ItoIYPFxWOlCTmXe03kkx-41FK3N1AU2f5XMivKHSeoNBRY0GCqDTuqVVX7eEOlRE3a3KHUXebmtlx6NTChc6D8zsbYwZESdTS4AePiXblZ72F8kJPom9L1BQee-8dxISq4TohWFacaSguThXe4ci4GQrdo1yOU5y_VHJkQ-mvOYuTqEHpXuL24vTiPzWHK_sNvZXDSTJmKsOlKICMFUjYEjD0YvsgLvVKLlrsGTqnTG3WRogHumr5trl8ksQbTPA7nHZurB78u9nyTk_7ZOkrB-dBy5rAVLVU4MiewgCFcChRj61Cj5LV6JEaosVpUK6AUnGvEctn23JRwiWRBCX5ouvpPIlvgpzS6AXgGPp_LRbhdE5GG6ZZ5AbvQhDZ9jGUjmOl4xM4nAZoWO29TcjREOgBE4cYWEaOpfUcyE1PlO9LyrXVNNhWPI-OUP-jbXnN0CtkbU6dqa_nyirzd2VSjFn_sGFhzD92LGoXY6pe2raUsuW_PIff7oyr2R5fKiuOUZPTn8XncH_iSl1T65uK-WLfndQ_5HTacASgPeHvBU156cjcxF3YX9j_lYpsCcYMnCiEKFFkcoCmaBjpB88FVC8vXkofRHDifTObUwDnfpyurV_SqcYKf9Z4EO6YC8jPSpzzNfoD0ZapIwrFDdv818_sxcilqLknfatmuq56S2pLDzhwe_h6V1NfyC93YkGPYtKUkmzJ5tbjHuyM1YoI846V4yFRdZYNr7cCG0MCEx1VtT-7eYLsqDxg3PfUEBzJzbjvx1lJ8LofTWMQsIEuX2jWwJBuM7Rhl6z3G58gZ877Gh39k2hLbfYwD5Y3N-MMrpdOwtCbpRPB10fB95yyrKVdwIFXVjhaqStkDJtLvVHuw8XzrBVNdoQFxoPtY_kX403Fkm2_gN_C1VYZUVcvIsmhT1CaJ8AbxoZub6Z01THh3A8v1NJO_DvRhmQPIScOiKjhkr6hFz1RHk7L5u5cUsC9W4c6iNYeJCdMfK2Sh7r9Fg6ClAnUw3ZLsfHCXj3XF_OVncpERZ0NCNyQpQhIRtwtEZvLjjS3uaqd9tRDAw_YthTcaG6Q56Vp5e8GrKtG5xe-HUjy9gx6rgs-OeFEQFaWAcxQfrX0PGn0iebKSy91VnedyrKY-Qmqk6MZzrGNcjawEiwDURpoz-Hd2_XxT2J9Jv3H0RteT1rpRJTBl6VI5ZuLcpnzu-1AGnzAmhkT3YFIBLiPAimlElji6k2NaU8kOfWV8gnBFIRwRnk37iQ9HL0W6duhekNJaWPevFXEPf1d1WqwfakkX3q2-uKzAj55E3LLzTswI8VDjWKlCUpAGKfmJ1b5c3AQEko6b6-MeJuxMGoV8q6KsayyX3R_6Fzaa93VdY_45qZZ_D2JaOOpeUUsCS7K9lFeIGpMjBjSdvR4yIEWdZUX9gWJ2FkKPbkNUQ-DPCKpYdVCbIY020fdPgXEDA08F3s-W7N4axTx4dWBONMW2_b5hNOE2NDn0flU4DbZ8Wb7bcScP65GevkDhJVCq9AIEcfiiBTa8XyRV_wrOPiVaQUFV4xEEVXEBfObzmzDj0QZrjTLxrqrB4IL3NbjT-y1vsunIQLzbYA_tTAsqi_qIM7vT85eDBEbWRWeu8nGBteTNZr73LeXWH6HmLnx_tPKwsZMAFj2qmIrs-QnqneRxyjcPgm8YBgS-cPKSXDaAo_2jAf2UiXAC_62_3--WguYfqiJRuRWHbcU5HkHkgR8tn3itF8QCBzLsS_mop1hxr1e-4srROiDIq1y_ysEA9NBTGkSPh-va-AeFKod4ayB_2bkCk5-UyuaBcdPxs7859VeC4rwW7DRPtwZdZ5J3DvuGSlmaDhi2Zzo3Pf5wJ3Q7WE5i0i5rcBN21ArG9Q2xtpPyKt5ItTysqG-fmLV6n-NwugbG-gjtpvyhomgBfvr7GQd8oEFtsYmA60cAKZDX_-8TyPCM5PCwIoYskB1ZXQ1Lh5nvmnj67ejb9vtWFOTVHQ5smTtbxqcNSRXpSHMTvBe105-SSRvhdU_Jqp6FuFbWgIZI2InrvJO_Ox3Q4qH0z850t9Usq8O83bHNFOYDQojXr1T8LYbJa5s4eeTm7jOeDJReXoX1AWVfqM5PTVcMR9F4d21zJPZSxKdiU4YhRBFyENnVyzddeTn_M5DpCjJzdr9Qmm2pAinpIoAyQAl26oDbHDXJS-RF_lX&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&rfl=1%2Chttps%253A%252F%252Fnaslovi.net%252F%240

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58811c9e91d3e57e16f0540eb469d74a3b767a0c04751554f3bf5e992755fea8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33345
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DDF7 42 B
63 B 75ms
74ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C3k1MfiPfgCY6EPc5lnL6HbAksfgfJ7GB9pMBprh1MVlWtRpsQp0tdZHX2_5oV1wRnhPCTKfwCIfYJh4yQpjrI0ZYdbEPO8oZGhV04ve_hoKC4Kkg

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame DDF7 3 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:50:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 675
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:50:34 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DDF7 138 KB
42 KB 390ms
316ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 12:01:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame DDF7 17 KB
7 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:57:02 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2FFA 624 B
559 B 215ms
136ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-AhjLrMu5ATAB&v=APEucNV8Au2LC7BDldtPmihfIL8fdGHOfmB32nt8n58yLd61iUChDFLIEQOwS2nsRtTA2Gf1FfCg9vrO-6zhBRa_fysitB6s0h9dolHOqtHE9JZ3hpBjBhNDNXyQ1BoPDwvA6OEhru1gV5R_y3dxdBIUD9RFY4yMjm7ohdOsXU9yKQ9WSR3lExA

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:49 GMT
expires: Tue, 05 Jul 2022 12:01:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 718D 14 KB
11 KB 229ms
151ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BxPK6j1hxnLt9oQCw4N_uYk2uo8O45wmQgDtPvpHXtVN45eMNkrwbsyLkZeP7pzq60j6NbnjQJc-WnpeHn3hUIEFd68MANbsHIbNmMJ1l8ZNnXcKh9YFwcMsZ-wc0jMccrdlRC3yXvW6ybnOU0aQb9s583xg&cry=1&dbm_d=AKAmf-BhVzv94EL4QcKF_Tk5fRUzRBbSHptXylqz2_GLhJQVQFLXLJujF_WVbulczjnGqa5bjXlBiunjCVhQqhGqKG4-IefBIBVbXZ4-ri8hwSZBRwG1KVDxA4dd8qf1THUQ6cE8qHneUoXp9c3PN1kpEWTrH4zGwQyDdE2XMC4hcImsl9yoJUtrA_dKZSSv-XgIml_vReXjfOykMhbX_KTdljWRO67AvSHi9CZrKLJfRyoxyvQDF-rYqZQ_H6WB4GoQGN0peOboCbaDKGgQsnkzxvMaVKaCnYtNEHnKHEeFI8qBpipeq75Wjo22rYdWL00qHgfo18k9Eo7ydzOJohcNKvP3VUr0c7HY16x1J69XFU8US5Ya0c1W1OyE1_wtJ6BFYjC7cnColbKvevvS-F-2cu3t1M0EMeEc8d30XzZMLkq-qhLpzAJEKbeSfeTY6nZjqMBcwJnMxKaoX3__-ZedXpFByINh1-RSqqc9dSyFhH0L7dNxGr6nWbcvZOf12ns5XhyFn8wVCZQHIYS56ItshIWjczviDXg7pHyy6Jmy2ocJfwwN1oNbK1v1b9mnieo1EKAv69KAlGvN25vszgD6nifrwDY2AaIsagEPWkC9ffzlExpOZrKKoyq-Ix0JA6yf7GIeiqkRgL5d3iYJE3ktAv6y7lQ5q1oZM_cS6-oiP3D1BSLoOG9muGz94vcvS0lMwpeVIZzf5pOWLE1_Ia45frFBf-h_kLaNpFW-ws9wqisjqNBxEL3RsbWGtQFCNnUX0mMWSyD1yGd1ZJNOh6cD90ITJqOetNTMFxTZjsg2XSGJmTY9rKjnhQR6uT02ce2zwg3SFV4MyJjkzBT51M-F4_bvt2NU-zeYlL5uDFb6DgSzxCehxNkBKbC4eUdZp9o-uX7KDyagt_Vc8DZbEr1wkqeQomaGJKNlws2zA37A5ajPZ4VszSm4KvcyQOfJBM8r-yI3_Cc3oP46WyjB9-WSRBVQnpWFDNQiOkvoa2VjPxIxrXudUyEcr6n14Oa-KfdC33oA6RrCKmC0Vym6vX9yJJkhbD94KZp7YjhdlWHYzdp_ZygNWPit2q4h084nP_jRhWxVYv8bHZwLSSwutspZnGePVS_xhbpNlL2WQBqikHJLUGYO9HQcrqxHeOyRMIg3aV8eYenwO055h6pKoPxCBnKbRw4A9rcDdONNFAlS-pbFW_qMmidAlUibb21I3w9yVl73lxdoIru8Ufb9UITGJ-xWUy0ru0QGt03leFGgqKzXztIyQLQdSHeShkqiZMK46OOPJ5jecB8LxppWyWbe6eY4B-CTe0PiGLz63Vw5Y50z0MAXjttxH470DqyA9Z68etf_1gQhRJbSC7BsLn9JfanynHLMbruyArkCeaLipxEFG5XThx6V5ve1FqzEYao33CyZs7eADqzIjI8-x-uJ0e8OTUkAS65v46evgu0gKd0BffC1NBdU8UGmkR78tE50RjrpMO3nHpNWN2UMQWpoi3-C5_3Mo8L1sGAcl2iTjjDJ3qzrTH7-p8QWQxSwQMb4ry6p9hsOvVag28lkWRcjEVFcs0fC2Tlbh5trHBJduywFSUSflsAvKqs3UxlrQv8n-EP6RU9_fzgDlB_lpWUnQ3KGx0NeCXz9ZsrdoYxcMHYrzWWszNTxarspudq_fRSaMWRYgBcTRR0ApceZDLEM-lsh05r884g4gHr6NQR840jAOJgu6gPD68Wrp4iJEPLFZJkYf7UGrEEGqObaM7ZwCZa_IeNcr5ROcUsRVJXn5AEvgp9XJNtsnxvteKsbpUGKAFjPayo5qqMK6jWyfbADWsEasyEEO80ruNCAA8emkENx7L1Gy2jwJIT6PVE3yRwgMT1Et37JTK5Z8I5J7rfuAga-qWqf9Jx3ri5191XbFlnaNVQbB9ATqVygxq6bYksQJZ0TFgzUeQe78VJ4eTnYayGR9I7bdRUg8fzLrkpfj86-A6ot2ErDkL-n6WVphLeg025rVduXPjRxeY-lV_rDupMz9q5ZVlwbfELYmoN2KNUy7IeMxPlpsZiMNmFLvxXjn1lbY9xSTwNoAEMwNd4k4QrozpTdroANr_Idw2CfDpzR9y0uMN_p66mSE-N4EHvfHje_JM__Wza_poL5M9NAbxLHGz5_F-cvhv0hzin3VG1aQx00r9a7HCrtWiq17a28KTuP4j-KQek95t8TjPrJqLSOjrZSakb7K8Y_IKb_KhDzMFtIDrX59ocEMbYnlA1PKHF639QuDRXv7TwUHpCADK2wc5nnFr8vPx3Yo-GYex77TSj9hC66KBl65UDFjQEuP7D_pq6e35y2w-uv6vagTIwVi37fVGSbaVxtR41HJ0D2DxrWJjMJ5TomKL0fVO-frKTq5dCSyob4u3jaFYjM3rl9jZPgRJBd_ysxtGiKX0Qxu4FCU1c0bwiE7TeLyFrbbRM-YLZl0-b9vrwpj4L9DOLactC_pmn04dhMSY4yhbTJERInWmS39DooWXjFHYeSDe9qI878HIBqYKEi17m_cky1GX5KmYiewx6UOAFNyG5mjiX74kAUXhXIVevye71yNXDn3F8w-cMqZntljn-Eh8Z4c5eyz5cfTl-IB4FSTXZmqyl9KxFHwwq7JIs3Esvsw7MHTAaiFBxwus_C4703ztYvrqWJrdeZYKgmuMdhrSr43vtDL-NRjXRRlAQgQm1xQKXym0egxq3jzSuVMiJ1Kv2MZSPgRzvHkqhnaTlOov8eD93cOSFuzbYLrpoHXyYiv_ID2UeSiscEMemxGnKpprtlsmdj5JnbOMHGJX--UzrVMcCTnn4rVGyfgkEjkoJulx5sSMNs&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&rfl=1%2Chttps%253A%252F%252Fnaslovi.net%252F%240

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17846df2752628df38c1744f86e7638679b42d77542d3023754d38ece2782956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10763
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 718D 42 B
63 B 74ms
73ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C3O6Xv4XuPORbDBeyqupZUS6dYKGRnsAP-UkCNS9rwVBFg2ETw6jKjgvjRJK8GflOdxAqKEUrgYNWohOfj5q1n1nTL4GrCX0wVr3azGhYjAtdm8KQ

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 718D 63 KB
22 KB 180ms
77ms Script
text/javascript 74.125.133.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWV4N1cy1XOWXOBS5e8WREQwdSaEkeqAS1dL9aii5J2GkkQo5g&d=CnkAoCZ_4MZqJ9cUs7kXPId60boyynlAgW8iyfYWHwgeHSqNddSdV6L5SlYfa-EF71x0__xFqIjUdfxgzMVuQy6hv3MXPJagRSOaHcptb_Q2_lazkUH2Abhh9kHyvq0aKzvEtFw5zp8MMPQtiv-kI0rzWvGWw_pm5F0hEqkTAKAmf-Djn3tQAW01zJDbLd-BnlLzHXxk7xh741EL1VvG7DqIpEm_-1enY9W4iFjtVvOWnM4TaBH2jiYCXh0CmYUf4x_y3qYrPxp1XDgaMiRht63cSDOenUyanLBRkeh_VJLeDGSKsa4DTgSGPQALxd2OrRYAaPSsFflc0bDHSfdx_o7MCBpDjBnViQYiup4l93gY-eNXuby8OSDq2skU_YlazH-PUjkJgv5eY-ET9yxW3vpLJMTxtSP5fXvxzwTkKTvnUXOIWnc4vWQ61ChF8JOsNAcn4Wj9zRAoriVGwGx8gEx4-KCFfRzSRPu9kdH3QxMUsSwPhBD0pbM8aRMOlzPiTeEz_qP3oTri-5ph6UINAMt0lCYFDZJHY6gXaP5BjUR6Dou0sJyyY3xsqlExQfz3-ZmFn8MBOODGoA6dB6iU2VQmZb9Spp018v0yrJWjo2rhFMiapPATxuAEWeeCIEFIr1fWDI5GlUKMevRCicgVtrmu7wPjoArXxh_ypiG8kAcJpQMr78Qm_40KNY_1G58o-NNBPHxToRtK5PHrKkvM45z17ZUF7noI0AvJPI4ptj36vb29bX6_r-nrQ65SZIdLSLaDAFL-PTW7ADXtdsOz7n1htDqlR9mgc7qFSdtjesOInZbCGYvp8ksNo3vyCTz0SHvRW4ERmDGnLw6NPM_PJHzdnJiB4s0wSpp-Fkhrnl519gle62m9uammIdH3TVne4GNxwuhAPbY5F05oJQYCbuOXwnSeuOr3YEQ1TqJW5v3Iy2ohrib1WE4c0hUY95Wta629WIooNXzv-ZC4DMQcph4w7j9xfEpaXYqPxWcgdDcW_NjUeox6K1Es0iHZqUruSY3GdThD5IY4Uvnca8IAgik-T8wvtt0PlzT4B8PmzyF42yTVy7uR-0F90IvlPElrCTk3wzAhgqlVDxQ1RjJ9nad1-GfQzVX8jyoGO3jLzLsbWbDo-6UFml6iUn4X5q0A4wj5wgjNCPN3PWHy5BsG_k7dCvDWcDIJAuHJfCKBH1yN6Nl__h51ENnQYws__nuj_rfHKuiI1y-1M2IC9MNC6DGXVgNVbxiUsLjW7L3we9WkC1PdGP1Li_48WnEOBKZ7aZmVlapy_ZPqmUhIgH86D8O_an0SKYrgxrmLNJ3PHArTkkEBIhUfaD-U78jjTMS_0HM_tDvBbUVNianHKsOTzoQbspIQTdKrydm5OXUA32Wq6Xi4NEhAk82lc-C73DmeUX_slSXiws_aE3pl15ql6s5R4v8bFMvuqqe4nNEbZxbyhBZi0FZaux9wwuoxlVfxH6CBoVoSDG0XgiFwPppEv6D-oKwR-zD7xKZ5-tNvZuZz6IsVsShgIb2-rvH-QI185phtH3xOYnSk6VI-BEwSY9ud4yUGX8BRu4-beq3rktrVmJysuO-CFLbuJc9U08TbqfhEKcJ9oLi5LzgAHAMnjkQUGMfZd9xpH2mK10pX7QBDcQEgO1oj0LPOPvd_WUJ3tw9fdZEUzzpf0KV11AbgxcceAtR0Ih7Ubi9oaoTKmGmxQq44XYIED4wU2rLytT9uMGmCO0Sj8tEPr86Tg5Sq-YI6P91FzjnqsB114_GfNwfJ_qAEKui23kpN6XrTydrF7I-70_mvvUAux7hZJvTuQL-RPU9hSF9LvEpgC0txGN92S5e9WjHUjbY0fy4edhRMNaF4gbWMUu2B_kz0-VWa523k63ALRGwfD8pGPBZy6C6RgBIYdVDU3lpLnIbXeHPlnOvfrWEWqSmu9Sd4PKtskkBRfatgmo4Bimr5aohnjf8pzTHAPy5EloDzweYj-O8TUYDGGMJcr6n2ba-ZH3lSY4csUlb-feg8YJG5oKxvZyZ2WhPJjPr5SJ4a3xoW3UYcaMVuNepQJ7kpleDwSIdcSHv8cCRzXFUNoCwWIMIWd5UebK8eLpcLSisWP6PPsYVogdV6av5DDWeB0AF_4qzQtZeopeKP0bw9qsM-qsQ_pmSM8i4VYhz5gDIKHPt7gZdPfQk2fidUgBF5yOFMhJ-xPQqawF9XGXt6hohYyE9sqKuJmQxhdOwpW414StA7m5yKxhbNxNhBbEB3tu2JvwPjqNxW3ns-nktzQErhTCn8JrFWSlcACxzIykTIlUNExgC9WCDtKvbDEDzyNQlAzC9gKtk-DqEkwbs4ONyiLob6ADI6j8x8g3K7K8flo7f66VQMkiIMLD3OHS0idjs3Mjaj_GmB1Q5jy0sXuqATT1NIP9T3bMyZYNO284CQQ3z3qI1iPtam82YPBx72lKj6F1h15Rh4AA9Ew1-ZoMhhIomKofnWf4UGASedpF9uKTc7RgxGYqAgAuuTWqgpaeUuGPpzhFm77sOuOB52MR4IpBjmeDETmihPt4H3-Zkjm9370OTfLbnw60rRBF6cCqxpCdkHecH7MUvexbIayE_0MPXCcD7jXk1dclDO3Au5691UwcTBxlnjESijL28C55fTpetPSza5OcpgCZv7bOA82sFm4S9Yp_8yAn-XOB6_HvgMgcHBui6yQ90atR-85jww5UED7ywfEj5-MEvvF0n0rP1AfpRqnVPqEgJe2ufhp0PqFPoN9Og274d4Y3aiCuAnhhGOJJQI0_AkQWsM0M7PnaF5Qm69nhkYgOCD3s37rbeVraBCv-gxTqws8PPlaguNmQFIz_pk91ZFURL1DtJw_xyQ0El1pELLYDeYazXGCls587QqtGphNUXSszyVtiadtPy4Hwn8PUoooHElfm-KqchCRwgj_Ri1pH2CRYuyMJ3XTkOzcZqKnJZg0XebKMKZgio9dY47jF3i8oaivQqL3XsjE9fDimQAAlr7mow8tpJY4JIXlaRUg04EgvJBNvxVUktZmQwJL9Pye7RL9KZ5QNKTeck-KLnvkdbe8cGDa6-Qmghk0dxXw_NlbnJ7A-GMcE-GbYN2Peo2NDqIxnYEhtuYsmDjSUjWfpdxX6IX52sfpSbt9CJQiIFdvwsVVpvR8-Fk2bzoX5ry1DjfYGQdbU1V8Jz3qnuiTLhXalJ5iWr_zj2MgcqOAOAEwO0iy7sZW7MSDD3Ju0f5-D-8dPxcHjlSz21AoQwrtzEZzXhadS1hR5YLD84283Iqt4gXhlAfe_x4SOZsTNemSeZrU5SSPPJhn6ePLWwTZcX-dzRsCyHnMn9Noay-ZDkq9P5s5c7jUE4unCxltE1zVXadX9CgfO2fcbvUngJ7Mef2AAqUxw3Me4QOM9uHZKIniit4l3o_ociNPGL5u34eDFKdy7e67UWBiNF4_sBbfepE3zrRzcua0hhuk9VscoHabRoyCAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFdgAQ

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f154.1e100.net

Software

cafe /

Resource Hash

c8f85fdff84283788978d782cfc1a346edb93fa041bb8f1344a4f9a8d045b9ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22241
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame 718D 27 KB
10 KB 138ms
42ms Script
text/javascript 143.204.215.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont2&w=300&h=250

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.88 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-88.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

23d18030fb10dbcd8f523ab970335dd0d46b5cc36865c85d28b525e0b24910d4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' ; prefetch-src 'self' ;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 09:35:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8792
cross-origin-embedder-policy: unsafe-none
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding, Origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
x-frame-options: SAMEORIGIN
expect-ct: max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript;charset=UTF-8
via: 1.1 15d3b4db3728feaae1780610a1bac86e.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: ZBiqzzgc63TwBAVMVtHiXWlmoumY_5NA9NyuE8dYRQkXwgNN6MzNeA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 718D 3 KB
1 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:50:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 675
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:50:34 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 718D 138 KB
42 KB 234ms
164ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 12:01:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame 718D 17 KB
7 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:57:02 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 690A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAMA3NZ7RpkOTKX-mfRE69E&google_cver=1

43 B
908 B

136ms
103ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAMA3NZ7RpkOTKX-mfRE69E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIYqozVvQEwAQ&v=APEucNV5I9Nj1mk_PISFVVUvgGDVxrgqlUrh0cj4_RZJCqCOHLf_QdIQ6A__GfbmhhsQCVFDamjHC8lXOL6Yxp5KDjWOyQtcnNiFBe6OcAMfaZ7GkZLRgUe4trjFUAMlRNqlunpGhFH8emiGj2erxVdpnfxZv6dGcVWc1tw0xgF-x1o8VPNQ-AM
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 725ff2bbce5588a3-LHR
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQRN4u%2BwLpWlXiPm1Y1eTamgRod24m4fyZ12wulJdN5rBOpuNq2AQZ%2FawsSkc464Ob4mVHxOysIiIgyeEMOE9uB3y09b%2FIZlsSRt5vCIvqt9Aa6T2yW4DBWJGtcSz2kVpREc4%2Frr9SIFFA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAMA3NZ7RpkOTKX-mfRE69E&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 690A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YsQoLYrUiaCxmVH7opexDAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1

43 B
905 B

65ms
64ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIYqozVvQEwAQ&v=APEucNV5I9Nj1mk_PISFVVUvgGDVxrgqlUrh0cj4_RZJCqCOHLf_QdIQ6A__GfbmhhsQCVFDamjHC8lXOL6Yxp5KDjWOyQtcnNiFBe6OcAMfaZ7GkZLRgUe4trjFUAMlRNqlunpGhFH8emiGj2erxVdpnfxZv6dGcVWc1tw0xgF-x1o8VPNQ-AM
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 725ff2bcf90288a3-LHR
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nLetmMr6PfVjbUGiw3r9jvzNxf3XfHbRL6stRa3GF5tHfVRwUxhA2mS9xUWG6G6Vxjywd17iUijGaQT%2FSi17KkBgikaUsRp9X5eLCqLX96Xb9qC9U77GH4SyrqhgpgzPUZKXjk5BlLovhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 690A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPnwfPzlGVVvvDdw1PS8Dtc&google_cver=1

43 B
1020 B

68ms
68ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPnwfPzlGVVvvDdw1PS8Dtc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIYqozVvQEwAQ&v=APEucNV5I9Nj1mk_PISFVVUvgGDVxrgqlUrh0cj4_RZJCqCOHLf_QdIQ6A__GfbmhhsQCVFDamjHC8lXOL6Yxp5KDjWOyQtcnNiFBe6OcAMfaZ7GkZLRgUe4trjFUAMlRNqlunpGhFH8emiGj2erxVdpnfxZv6dGcVWc1tw0xgF-x1o8VPNQ-AM

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:49 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: b72e95ae-b268-4b38-86f5-6bd431e0180a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPnwfPzlGVVvvDdw1PS8Dtc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 690A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQxMzIzODIzMDE4NDIzODMzNA%3D%3D

170 B
243 B

61ms
61ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQxMzIzODIzMDE4NDIzODMzNA%3D%3D

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:49 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5e8a6ada-3887-44bf-bd2b-0d563f9763c8
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQxMzIzODIzMDE4NDIzODMzNA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame B520
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAMA3NZ7RpkOTKX-mfRE69E&google_cver=1

43 B
912 B

131ms
105ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAMA3NZ7RpkOTKX-mfRE69E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIY44vVvQEwAQ&v=APEucNUpWNME02ecU8e5WGPIFhPipMtfgwK0FJeSaFYCLryj68JpegDbTaOb2LhhTH8RNX6SSTG26sKai-C1HJPYTwX_QgnHbRLZDhLBrrIEg214FH3_srLgWODhuHWH_8bROWVE8UWwajarI8EQgHcJWFoctWqYd1Mk0g5z3aJyZ5n1HxUP7HA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 725ff2bbce5988a3-LHR
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kuzRXWxl5Z%2F99H7RKvmxzMTezBn6BeTApYD4gXCVpqODv%2BK3Cso9PxH%2BL61FiFrnLeAk3ytekgFX1Cc5LxSBVkfvdY6%2FxgH0y%2Bx6VRuO1Z6zwvYLFqZPOS8NOyMRbFK3L1PF0FkfpUnG6g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAMA3NZ7RpkOTKX-mfRE69E&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame B520
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YsQoLd20Cqa6XfWb9gIkgwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1

43 B
908 B

85ms
83ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIY44vVvQEwAQ&v=APEucNUpWNME02ecU8e5WGPIFhPipMtfgwK0FJeSaFYCLryj68JpegDbTaOb2LhhTH8RNX6SSTG26sKai-C1HJPYTwX_QgnHbRLZDhLBrrIEg214FH3_srLgWODhuHWH_8bROWVE8UWwajarI8EQgHcJWFoctWqYd1Mk0g5z3aJyZ5n1HxUP7HA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 725ff2bcf90088a3-LHR
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9tGkpJXMBTKl%2Bd%2F9IIPXnS%2FuiYDQkqafHQoVJwMbTsqkuvs6f4E4KwP4s7vxgUulj7uzgnE0RHcCGsvfa6BNn6OnkkEjWKWn5oRVBDU8fc8ctZ0H18X8ihz%2FqrGZg97TO7xmedRIgXFVpg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame B520
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPnwfPzlGVVvvDdw1PS8Dtc&google_cver=1

43 B
1020 B

76ms
69ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPnwfPzlGVVvvDdw1PS8Dtc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ1JWwgwIY44vVvQEwAQ&v=APEucNUpWNME02ecU8e5WGPIFhPipMtfgwK0FJeSaFYCLryj68JpegDbTaOb2LhhTH8RNX6SSTG26sKai-C1HJPYTwX_QgnHbRLZDhLBrrIEg214FH3_srLgWODhuHWH_8bROWVE8UWwajarI8EQgHcJWFoctWqYd1Mk0g5z3aJyZ5n1HxUP7HA

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:49 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: fee17976-8565-4b2e-8619-f0bf38fbe716
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPnwfPzlGVVvvDdw1PS8Dtc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B520
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY4MzU2OTc3NzI0NDY4Njg5Nw%3D%3D

170 B
188 B

137ms
52ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY4MzU2OTc3NzI0NDY4Njg5Nw%3D%3D

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:49 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 17c6d8b3-72ab-46e4-bb85-569f7d278443
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY4MzU2OTc3NzI0NDY4Njg5Nw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame DDF7 106 KB
38 KB 182ms
41ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Origin: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4553
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Jul 2022 10:45:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/ Frame DDF7 8 KB
3 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AFQcSMtmFKDmkVBdaOIilqxr8zZsqBCRiruvATKu3OKypGVHLmcEtBydtNKCkaw1y2ytmHwh93GxN0j3zXrtihL0ZaJzqIYfIlbBUpkRqeot4Um2EQEI-TRFLD2Rqd8Nt6bltzxc7b6cEI5tnkCp3cE7YEnA&dbm_d=AKAmf-CdfkWvI3A_OK_iJW1GTEZfsl_pDBKV_WgXp2pywEKB066lgS_PZxuXdtkAQhggoG_nsM-E3-jMQ_5Ku7FTaxg9mDz1Xt_HuRNx-0_cGmS9ahHSie_sVOatmx0eN66P4Nn47VnEEG903y3leQfhgCwBD01zqpJWmVPvVvQyHhFc5AjRq5FpfRbSOWkqk-GMjQPAdNLJhsys9zPl5lLjzyw8nagdmw6aFRZxWlILHQdpldC9hBc_7uv1YIHyL1I7ui1EN8UZpgshQpozX7NUnIobXT_15WyP3yFpOX5YG63U91j6tDZ3hFnko0-WMwhy6TVupdxYDQbWWotMofiBNLD_DFLg3aKGX4eONds3XhkyovuinOgya8Njmiw8LQSxzJxl8LKgkQscFawdv5uhmngzTDCdasFzRRK7K_2vTMHKEckHu99OsxroaW1kC_iXj_xCD9Iv19kumBkaGrgKorDyal8DvWJ5So-ZcHpVzC9UUK4-Kl_Wg5xV2Zh5rTGWkI0BXadui8cJrBPptFrtlE45XpuR-pj3SSWmA-s27QIpLYf19z-rciiwK-FLZKd5nPH9c-rmMtY_y_8DyHjo0HyjyFgzJ0wNKWzqDxuXyQWqHvKe_3Lk_MFwjoUnHlUJ7G9bkNs9qUBQVS9V7DtXIl3jg1yAbQnkgRhy7iO3Mp39ze4IUT5tMrYzrwuQl2ZhiOGSzP_Eo2R1eesolFiz1pNH0XnyGDBhfEL48mKhdaQxOLs3pCm_syozycjWQ-yfAQTYkXr035GahNq41Gq6ZsIBGbwlI3_6UjUSFiumfc_cKVQWaahj9IKltH6hY4BZD58FkU6KJCYmWslwpzySvPV56555pmMnkYBlFwYEX5CvjQT4RhdXr04589SHqV3TBOhT4ApVZdtVXePQRk-2aE_9xTei8cxkJjcHGBfpxXqssie_IIKqPPe6Yut7OnpHLuTB_Lc_SlQDN5-1k4b_RF6AxDloFLufkINTFP1HRPuhX6PnapX-JoRFoxZHLKhARJzD2dt6qWZF5fnKv4eVivGfGPytI6o1mV6ypHnM3A3xFJrCNhVKjvMOSvvnJ0VkL9OAsLZMOsdNExjL0Urpy4aektgEHkKR0dsxLv-yRxixh0ItoIYPFxWOlCTmXe03kkx-41FK3N1AU2f5XMivKHSeoNBRY0GCqDTuqVVX7eEOlRE3a3KHUXebmtlx6NTChc6D8zsbYwZESdTS4AePiXblZ72F8kJPom9L1BQee-8dxISq4TohWFacaSguThXe4ci4GQrdo1yOU5y_VHJkQ-mvOYuTqEHpXuL24vTiPzWHK_sNvZXDSTJmKsOlKICMFUjYEjD0YvsgLvVKLlrsGTqnTG3WRogHumr5trl8ksQbTPA7nHZurB78u9nyTk_7ZOkrB-dBy5rAVLVU4MiewgCFcChRj61Cj5LV6JEaosVpUK6AUnGvEctn23JRwiWRBCX5ouvpPIlvgpzS6AXgGPp_LRbhdE5GG6ZZ5AbvQhDZ9jGUjmOl4xM4nAZoWO29TcjREOgBE4cYWEaOpfUcyE1PlO9LyrXVNNhWPI-OUP-jbXnN0CtkbU6dqa_nyirzd2VSjFn_sGFhzD92LGoXY6pe2raUsuW_PIff7oyr2R5fKiuOUZPTn8XncH_iSl1T65uK-WLfndQ_5HTacASgPeHvBU156cjcxF3YX9j_lYpsCcYMnCiEKFFkcoCmaBjpB88FVC8vXkofRHDifTObUwDnfpyurV_SqcYKf9Z4EO6YC8jPSpzzNfoD0ZapIwrFDdv818_sxcilqLknfatmuq56S2pLDzhwe_h6V1NfyC93YkGPYtKUkmzJ5tbjHuyM1YoI846V4yFRdZYNr7cCG0MCEx1VtT-7eYLsqDxg3PfUEBzJzbjvx1lJ8LofTWMQsIEuX2jWwJBuM7Rhl6z3G58gZ877Gh39k2hLbfYwD5Y3N-MMrpdOwtCbpRPB10fB95yyrKVdwIFXVjhaqStkDJtLvVHuw8XzrBVNdoQFxoPtY_kX403Fkm2_gN_C1VYZUVcvIsmhT1CaJ8AbxoZub6Z01THh3A8v1NJO_DvRhmQPIScOiKjhkr6hFz1RHk7L5u5cUsC9W4c6iNYeJCdMfK2Sh7r9Fg6ClAnUw3ZLsfHCXj3XF_OVncpERZ0NCNyQpQhIRtwtEZvLjjS3uaqd9tRDAw_YthTcaG6Q56Vp5e8GrKtG5xe-HUjy9gx6rgs-OeFEQFaWAcxQfrX0PGn0iebKSy91VnedyrKY-Qmqk6MZzrGNcjawEiwDURpoz-Hd2_XxT2J9Jv3H0RteT1rpRJTBl6VI5ZuLcpnzu-1AGnzAmhkT3YFIBLiPAimlElji6k2NaU8kOfWV8gnBFIRwRnk37iQ9HL0W6duhekNJaWPevFXEPf1d1WqwfakkX3q2-uKzAj55E3LLzTswI8VDjWKlCUpAGKfmJ1b5c3AQEko6b6-MeJuxMGoV8q6KsayyX3R_6Fzaa93VdY_45qZZ_D2JaOOpeUUsCS7K9lFeIGpMjBjSdvR4yIEWdZUX9gWJ2FkKPbkNUQ-DPCKpYdVCbIY020fdPgXEDA08F3s-W7N4axTx4dWBONMW2_b5hNOE2NDn0flU4DbZ8Wb7bcScP65GevkDhJVCq9AIEcfiiBTa8XyRV_wrOPiVaQUFV4xEEVXEBfObzmzDj0QZrjTLxrqrB4IL3NbjT-y1vsunIQLzbYA_tTAsqi_qIM7vT85eDBEbWRWeu8nGBteTNZr73LeXWH6HmLnx_tPKwsZMAFj2qmIrs-QnqneRxyjcPgm8YBgS-cPKSXDaAo_2jAf2UiXAC_62_3--WguYfqiJRuRWHbcU5HkHkgR8tn3itF8QCBzLsS_mop1hxr1e-4srROiDIq1y_ysEA9NBTGkSPh-va-AeFKod4ayB_2bkCk5-UyuaBcdPxs7859VeC4rwW7DRPtwZdZ5J3DvuGSlmaDhi2Zzo3Pf5wJ3Q7WE5i0i5rcBN21ArG9Q2xtpPyKt5ItTysqG-fmLV6n-NwugbG-gjtpvyhomgBfvr7GQd8oEFtsYmA60cAKZDX_-8TyPCM5PCwIoYskB1ZXQ1Lh5nvmnj67ejb9vtWFOTVHQ5smTtbxqcNSRXpSHMTvBe105-SSRvhdU_Jqp6FuFbWgIZI2InrvJO_Ox3Q4qH0z850t9Usq8O83bHNFOYDQojXr1T8LYbJa5s4eeTm7jOeDJReXoX1AWVfqM5PTVcMR9F4d21zJPZSxKdiU4YhRBFyENnVyzddeTn_M5DpCjJzdr9Qmm2pAinpIoAyQAl26oDbHDXJS-RF_lX&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&rfl=1%2Chttps%253A%252F%252Fnaslovi.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:58:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:58:19 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/ Frame DDF7 27 KB
10 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8247e71c60f01cce914615568139113018a1a129dceb0fe0af55edb0211b8fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:57:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10545
x-xss-protection: 0
server: cafe
etag: 4672069523611413616
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:57:51 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2FFA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBXX5f_j-JAlfdfj5r1ktPw&google_cver=1

43 B
951 B

116ms
90ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBXX5f_j-JAlfdfj5r1ktPw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-AhjLrMu5ATAB&v=APEucNV8Au2LC7BDldtPmihfIL8fdGHOfmB32nt8n58yLd61iUChDFLIEQOwS2nsRtTA2Gf1FfCg9vrO-6zhBRa_fysitB6s0h9dolHOqtHE9JZ3hpBjBhNDNXyQ1BoPDwvA6OEhru1gV5R_y3dxdBIUD9RFY4yMjm7ohdOsXU9yKQ9WSR3lExA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 725ff2bbce5f88a3-LHR
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cqln%2B3cR9NDxvqUEOJQePpiz78CPFlqMV%2BdWlt%2ByF4Q%2Ba8r%2BiD3tKK9WIRacd30QVIYtYzI32sm8Rokx58ELJU%2BiAwwGFVcDSnluHVfevi%2FohDUBxaPc0M%2FNhY1yVyrPFvsfslOExS%2FLvA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBXX5f_j-JAlfdfj5r1ktPw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2FFA
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YsQoLehFrJ4eZS8.chmkPgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1&google_hm=2

43 B
914 B

68ms
66ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-AhjLrMu5ATAB&v=APEucNV8Au2LC7BDldtPmihfIL8fdGHOfmB32nt8n58yLd61iUChDFLIEQOwS2nsRtTA2Gf1FfCg9vrO-6zhBRa_fysitB6s0h9dolHOqtHE9JZ3hpBjBhNDNXyQ1BoPDwvA6OEhru1gV5R_y3dxdBIUD9RFY4yMjm7ohdOsXU9yKQ9WSR3lExA
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 725ff2bd399288a3-LHR
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bse%2BW0Gm1gYyTKD9plEA7Tru3G4yk8iPxpDizotvLj84b%2BB%2F6ap1WV%2BEsy01Wk74Q%2BYY2eVr%2FC4LCvuNT%2BQ2Og5hZPFBToeAphWxAlzWJRB57tAe%2BI%2F7gm8y7vErBsRho2ZLnAQzOWRz4w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE1X3metfD3swFPSQ9tLq-8&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2FFA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEOXQmBn44AnfVoeI-9VSRr4&google_cver=1

43 B
1020 B

70ms
66ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEOXQmBn44AnfVoeI-9VSRr4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-AhjLrMu5ATAB&v=APEucNV8Au2LC7BDldtPmihfIL8fdGHOfmB32nt8n58yLd61iUChDFLIEQOwS2nsRtTA2Gf1FfCg9vrO-6zhBRa_fysitB6s0h9dolHOqtHE9JZ3hpBjBhNDNXyQ1BoPDwvA6OEhru1gV5R_y3dxdBIUD9RFY4yMjm7ohdOsXU9yKQ9WSR3lExA

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:49 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 439068f0-2af2-4da8-83f4-50224eaa6cc0
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEOXQmBn44AnfVoeI-9VSRr4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2FFA
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQxMzIzODIzMDE4NDIzODMzNA%3D%3D

170 B
188 B

139ms
53ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQxMzIzODIzMDE4NDIzODMzNA%3D%3D

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:49 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 76d5d4b2-7c03-4ab8-be56-b93d742d9e16
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQxMzIzODIzMDE4NDIzODMzNA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame A294 106 KB
37 KB 196ms
86ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Origin: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4553
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Jul 2022 10:45:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/ Frame A294 8 KB
3 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DcspT7lUO88n3ov4vorUrmQyj2dFdn7vdZK5Xl-jBb6e3p2Z-7IsRpeKzesZqofeCb-ISxLvfHXE903hjb8XNgz2kz76Y0OF2BUf2cSmTl8EI6bcg7N8A0OlsXzJwC7BXnqSDANqEHqOSKj_UJj8IegoXHJg&dbm_d=AKAmf-D59kchE-pQP0CMkV26HCai0kVYVr4UIv5z-WNzuGXTdkOj3GRt3vZ7xTEItlplsRf1rzFv_EvPWQILeJJ-CMfqOtnQJ846UyrroESM3rWogB4MdRgIIRkARoWBH3sniuTG0ag-Ji45CQ6smSBVwcTMjcKtyZ_JLjNtL4FQY_ZhinhuasuWzRFsy36riZCv4M8JwUNyh_cYCQ6U7HVh4gudtF-GnZEPX0ZozkXodGKYWFRi4fLZve43pWnKS1dDY-LyvzNGywBPNkp7Q1e0KfWgoF8b8wwAGjVYVMQwPvoev7feEY7MKToThbTmCbWvdKFDU5Btru3Tyf8-f7vqclZGMontsYobHa3t1BDtvPyve2tzyyFY2kxFW48QeStutyjYYF4P66x6x9YUsHl5u3Cdf8kHUdObVWTqsz-c1EKFY8yBqS7iveYP8sZzK_EC5PolBivOIzudIVSuUOAajU8lvEEPv2-h73k4DLUXRKpQtcLcyeKgKuOJunJjx3ObWOOhgN2SiDmGf5yNotUYh1lQd6poc04QZxdepwmRDQndoKJWMhByXDcFYRF777rEYLoFp1U6ocHgQ9Bp-nUdHC8TCCxFswuKvvANyQdajo7M8mIkSe5YkAj_0NqDhfBRMRVBCvZQEH0FX0XJL1Ga7Q4RIJTU9oEXUK2kFa5Z-DC8X61aXsEjlGIckzxDdKXItwg7G7tGjHRPtPsqMkzePltpmnYa8Vubsl4u7H-E4mzee7sqqs-m2qthOvw9tkNVB0c5necO7NHW1BPVZTmU0qBdeOBE7wrue1sjsVQ1ujg3iT_BNyTfxoBzLagxy89J-x5WtL5XzoaHGOHAn4mJY_88dd4Iipka18GRyiCe3Dnt-RQupBirpZ8ccJGKSMyXEqHk9j9S-PQKQHvPCmf4FRPK83Jb5p5wlIUMPrWLgl4wFhWIba01f_7NagkrGqfD476BGUNLeviO-LEK3kqYjv4GnDXhyXQDJKHvQRxxj1kwKZ7sUjvYVcc0xaFY82CQfH45OIGQJuMwO0fXOwY5bbHSVsKjnl9dYCqtvjB6Q0oMyz47AZ9g7evAnqtgRVE6yV8-x5Cfc1qxaWnI97dPYyudamA-5IWY1LFaTak9zGoRTcxVtb9YSlT58W_SCaDfQ9tXmro4h6jFfZe5aavE8DxD9ozWIBRUUksdVDMJKVrxY3pr6zIMTMWyofYOMiWT3B563NrPCnaqnBDST3R1QboGDIOauOQ55LSn5UVqxST9CKiHz2ofU9hsh4_swwySEsNMQonYBJSXIBLRK39VK5fJd-opiQg71lx5cbzMuo_iDi-Kl3Ke0r2kVigdb6JBnATS8ivZSxuhX-f-4JHUnkp6-JOh3XaM4xQwCWcXaK4HEnEzj0iX1P_gqEeByyu9JKNi7yTWUQ9dNs-rI2zPKuHeYs1ET3ISFAMieethyVflPFkmk1ZEl4K1TtiM09ONDVzPxZxSJbifvDZ1Q6k1pUP_wRY03pFtPdRyPfNmJhEc5bxZixxV2KGfgzUE9Ms9uskilBft1KXlMxVqst1nlqBkgr6yyj35KNswDOW0S7A7hdjZGn5LuSWiA0-Yl_iowxB5VmEAolv4cTJ6wMMwWWzPlHwmzdtjr1PQPSJ5JtgrpVlhyGCX27Yhe_aYxHC3W-v9xzGAJYM6i4tp-qWs0eFmaM64HoJhJbxI7BWO4dzBhh1SFM2EXdYB8KkYOdKt4NrHxUWnPOG6YIJRIwWqx5TojSmGV0BzXBsAwKbUC8HFDUb6S7xtSKbsMNGZX5ubbV2RNbZx5vhmBW1cSX-0NkurT7mlfQ3xo-KHHH61qeDro3DeOM-9xJarpTe4NPPkb-q7lOKTILyWxZMNAidhHjSQnwj3JTFKVEI2KSy-yZY94lGnx_9yRVPPf7wasAYFl6QIZxEBTaIuue2HYYmzawfOdvQgYBgAGuIf7jhs6p0dT_SfN_pPKOv4ReHfiO6gtJeuUCoiEX5mY093G5wTYJcAj8-WoN21omzhCwk2LwQFhEmTjlb2-EEZkOdwfEXNxPw5QZO0x4zBQ3rJWAz94gfmJYP2XsEpUiwx4MUu3Ei3iJE5faP1fcYvvbVdBFLvtfGYOTLG5DN2IqM5A4QoIZS8YRPLy9RlzsjcLDBPC9DQJqyl1XBVxKqjrI-GNKhLvPwvnmYlzUSmbOfkZ2TSibrwXFrhgoYYJE83aXMWirMq_IVBsqU4tGocf19jwOB3uzSQX7siUxWL3IXNKZuvuXdhJao1QZ14qou3dhxlqi0HbqQ-K-RB5G78e5-83FNpzyLclee_YD5EPoRe91uQjM24mH-J5uWQ77sz5kcPOT6G5Yih3lnLB12CJT6WJf5mhnlLeWX2Nr_akE2AMb0jQbU7oS7A1QOcbZwhqwiu305qf8ao7hhCPnCR1gnr22yiM40mXs2xuK_205YeE7MwWAeW_ECcC1Vz-onJ0SI_A9oDNZTVbSQuk7801EQv-n504Ek9OScd6aiD5v6Ogy5xbcsbQUI6ksauymnISBN7yMUi20_0fKSvw-3M13nnmJ4IK2A7Lq3V1UQql5ZdSsD4pEreU9TFprllT4WwS2uIboAmGjLNC9bydQSGNNJLfk0XibbgddfSHh5dry8EizKKnZHDayjuwg1nSJkDbJtO5UfV8SU2DXm9750mEs6-aaZlBKuJKup52xs3YekUte4lCWPHBy9CYmxSdZm-iZS6AKYYYT9Wzgt0uBcimgXLud6OHYrxy8BaHhFtCEzMMMVkKqxhKCMrBHqd7-Lk5KnTvW0haTBhznMJk_LNVyZdwRf72PNfvYSFSTBgBoz3HD8QSKjWzcKRpTPvlekqFjdDuPq1c4nR5Gjt1J3krrQ0HJmbpvVDcHcvpCqHb2nkNlc39BlbomcQZwmq2HzLZkO4XbdKgw3CoM59zEw9IGXvBJLQJxkkocEP-WPkQ_LCmUpndJTVFt_kATIpxCkzBp_POv3CbzToEKoUYDuYkhOTp5L5HDJsGLnuz69uqH3TSHMnsVqdDGEBAPJa-SPW1TDHgl8ioJcTAjR9BaCiJ4kDjwP5hmnGj9nuMr1_BH1ZLe_58KPCZINjb2cjzUeidKSrHsYFu0qj0ywG6PyqMGP3vJnHnhxKQc18aZskL1YaitHT9B47fZ9I8DCKBRFW-biv2CVRBcAgrxhTXjxjafr_sd0ygHGrWtXBvf2T6FdUmW3e9hioVK5NMxFFobTmCeEfRWEC_DwZ8LqFgBeuQI7tCqzWpckXsVWBpu6xT_LANqYdxveueFc7FREyiTppblziD_ruKjiSwDSUguqH9guhlrhDi1ASGLQ2&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&rfl=1%2Chttps%253A%252F%252Fnaslovi.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:58:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:58:19 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/ Frame A294 27 KB
10 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8247e71c60f01cce914615568139113018a1a129dceb0fe0af55edb0211b8fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:57:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10545
x-xss-protection: 0
server: cafe
etag: 4672069523611413616
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:57:51 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 718D 41 KB
15 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BxPK6j1hxnLt9oQCw4N_uYk2uo8O45wmQgDtPvpHXtVN45eMNkrwbsyLkZeP7pzq60j6NbnjQJc-WnpeHn3hUIEFd68MANbsHIbNmMJ1l8ZNnXcKh9YFwcMsZ-wc0jMccrdlRC3yXvW6ybnOU0aQb9s583xg&cry=1&dbm_d=AKAmf-BhVzv94EL4QcKF_Tk5fRUzRBbSHptXylqz2_GLhJQVQFLXLJujF_WVbulczjnGqa5bjXlBiunjCVhQqhGqKG4-IefBIBVbXZ4-ri8hwSZBRwG1KVDxA4dd8qf1THUQ6cE8qHneUoXp9c3PN1kpEWTrH4zGwQyDdE2XMC4hcImsl9yoJUtrA_dKZSSv-XgIml_vReXjfOykMhbX_KTdljWRO67AvSHi9CZrKLJfRyoxyvQDF-rYqZQ_H6WB4GoQGN0peOboCbaDKGgQsnkzxvMaVKaCnYtNEHnKHEeFI8qBpipeq75Wjo22rYdWL00qHgfo18k9Eo7ydzOJohcNKvP3VUr0c7HY16x1J69XFU8US5Ya0c1W1OyE1_wtJ6BFYjC7cnColbKvevvS-F-2cu3t1M0EMeEc8d30XzZMLkq-qhLpzAJEKbeSfeTY6nZjqMBcwJnMxKaoX3__-ZedXpFByINh1-RSqqc9dSyFhH0L7dNxGr6nWbcvZOf12ns5XhyFn8wVCZQHIYS56ItshIWjczviDXg7pHyy6Jmy2ocJfwwN1oNbK1v1b9mnieo1EKAv69KAlGvN25vszgD6nifrwDY2AaIsagEPWkC9ffzlExpOZrKKoyq-Ix0JA6yf7GIeiqkRgL5d3iYJE3ktAv6y7lQ5q1oZM_cS6-oiP3D1BSLoOG9muGz94vcvS0lMwpeVIZzf5pOWLE1_Ia45frFBf-h_kLaNpFW-ws9wqisjqNBxEL3RsbWGtQFCNnUX0mMWSyD1yGd1ZJNOh6cD90ITJqOetNTMFxTZjsg2XSGJmTY9rKjnhQR6uT02ce2zwg3SFV4MyJjkzBT51M-F4_bvt2NU-zeYlL5uDFb6DgSzxCehxNkBKbC4eUdZp9o-uX7KDyagt_Vc8DZbEr1wkqeQomaGJKNlws2zA37A5ajPZ4VszSm4KvcyQOfJBM8r-yI3_Cc3oP46WyjB9-WSRBVQnpWFDNQiOkvoa2VjPxIxrXudUyEcr6n14Oa-KfdC33oA6RrCKmC0Vym6vX9yJJkhbD94KZp7YjhdlWHYzdp_ZygNWPit2q4h084nP_jRhWxVYv8bHZwLSSwutspZnGePVS_xhbpNlL2WQBqikHJLUGYO9HQcrqxHeOyRMIg3aV8eYenwO055h6pKoPxCBnKbRw4A9rcDdONNFAlS-pbFW_qMmidAlUibb21I3w9yVl73lxdoIru8Ufb9UITGJ-xWUy0ru0QGt03leFGgqKzXztIyQLQdSHeShkqiZMK46OOPJ5jecB8LxppWyWbe6eY4B-CTe0PiGLz63Vw5Y50z0MAXjttxH470DqyA9Z68etf_1gQhRJbSC7BsLn9JfanynHLMbruyArkCeaLipxEFG5XThx6V5ve1FqzEYao33CyZs7eADqzIjI8-x-uJ0e8OTUkAS65v46evgu0gKd0BffC1NBdU8UGmkR78tE50RjrpMO3nHpNWN2UMQWpoi3-C5_3Mo8L1sGAcl2iTjjDJ3qzrTH7-p8QWQxSwQMb4ry6p9hsOvVag28lkWRcjEVFcs0fC2Tlbh5trHBJduywFSUSflsAvKqs3UxlrQv8n-EP6RU9_fzgDlB_lpWUnQ3KGx0NeCXz9ZsrdoYxcMHYrzWWszNTxarspudq_fRSaMWRYgBcTRR0ApceZDLEM-lsh05r884g4gHr6NQR840jAOJgu6gPD68Wrp4iJEPLFZJkYf7UGrEEGqObaM7ZwCZa_IeNcr5ROcUsRVJXn5AEvgp9XJNtsnxvteKsbpUGKAFjPayo5qqMK6jWyfbADWsEasyEEO80ruNCAA8emkENx7L1Gy2jwJIT6PVE3yRwgMT1Et37JTK5Z8I5J7rfuAga-qWqf9Jx3ri5191XbFlnaNVQbB9ATqVygxq6bYksQJZ0TFgzUeQe78VJ4eTnYayGR9I7bdRUg8fzLrkpfj86-A6ot2ErDkL-n6WVphLeg025rVduXPjRxeY-lV_rDupMz9q5ZVlwbfELYmoN2KNUy7IeMxPlpsZiMNmFLvxXjn1lbY9xSTwNoAEMwNd4k4QrozpTdroANr_Idw2CfDpzR9y0uMN_p66mSE-N4EHvfHje_JM__Wza_poL5M9NAbxLHGz5_F-cvhv0hzin3VG1aQx00r9a7HCrtWiq17a28KTuP4j-KQek95t8TjPrJqLSOjrZSakb7K8Y_IKb_KhDzMFtIDrX59ocEMbYnlA1PKHF639QuDRXv7TwUHpCADK2wc5nnFr8vPx3Yo-GYex77TSj9hC66KBl65UDFjQEuP7D_pq6e35y2w-uv6vagTIwVi37fVGSbaVxtR41HJ0D2DxrWJjMJ5TomKL0fVO-frKTq5dCSyob4u3jaFYjM3rl9jZPgRJBd_ysxtGiKX0Qxu4FCU1c0bwiE7TeLyFrbbRM-YLZl0-b9vrwpj4L9DOLactC_pmn04dhMSY4yhbTJERInWmS39DooWXjFHYeSDe9qI878HIBqYKEi17m_cky1GX5KmYiewx6UOAFNyG5mjiX74kAUXhXIVevye71yNXDn3F8w-cMqZntljn-Eh8Z4c5eyz5cfTl-IB4FSTXZmqyl9KxFHwwq7JIs3Esvsw7MHTAaiFBxwus_C4703ztYvrqWJrdeZYKgmuMdhrSr43vtDL-NRjXRRlAQgQm1xQKXym0egxq3jzSuVMiJ1Kv2MZSPgRzvHkqhnaTlOov8eD93cOSFuzbYLrpoHXyYiv_ID2UeSiscEMemxGnKpprtlsmdj5JnbOMHGJX--UzrVMcCTnn4rVGyfgkEjkoJulx5sSMNs&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&rfl=1%2Chttps%253A%252F%252Fnaslovi.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 11:50:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87091
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Jul 2023 11:50:18 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 718D 106 KB
37 KB 200ms
114ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Origin: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4553
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Jul 2022 10:45:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/ Frame 718D 8 KB
3 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/omrhp.js

Requested by

Host: bid.g.doubleclick.net
URL: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWV4N1cy1XOWXOBS5e8WREQwdSaEkeqAS1dL9aii5J2GkkQo5g&d=CnkAoCZ_4MZqJ9cUs7kXPId60boyynlAgW8iyfYWHwgeHSqNddSdV6L5SlYfa-EF71x0__xFqIjUdfxgzMVuQy6hv3MXPJagRSOaHcptb_Q2_lazkUH2Abhh9kHyvq0aKzvEtFw5zp8MMPQtiv-kI0rzWvGWw_pm5F0hEqkTAKAmf-Djn3tQAW01zJDbLd-BnlLzHXxk7xh741EL1VvG7DqIpEm_-1enY9W4iFjtVvOWnM4TaBH2jiYCXh0CmYUf4x_y3qYrPxp1XDgaMiRht63cSDOenUyanLBRkeh_VJLeDGSKsa4DTgSGPQALxd2OrRYAaPSsFflc0bDHSfdx_o7MCBpDjBnViQYiup4l93gY-eNXuby8OSDq2skU_YlazH-PUjkJgv5eY-ET9yxW3vpLJMTxtSP5fXvxzwTkKTvnUXOIWnc4vWQ61ChF8JOsNAcn4Wj9zRAoriVGwGx8gEx4-KCFfRzSRPu9kdH3QxMUsSwPhBD0pbM8aRMOlzPiTeEz_qP3oTri-5ph6UINAMt0lCYFDZJHY6gXaP5BjUR6Dou0sJyyY3xsqlExQfz3-ZmFn8MBOODGoA6dB6iU2VQmZb9Spp018v0yrJWjo2rhFMiapPATxuAEWeeCIEFIr1fWDI5GlUKMevRCicgVtrmu7wPjoArXxh_ypiG8kAcJpQMr78Qm_40KNY_1G58o-NNBPHxToRtK5PHrKkvM45z17ZUF7noI0AvJPI4ptj36vb29bX6_r-nrQ65SZIdLSLaDAFL-PTW7ADXtdsOz7n1htDqlR9mgc7qFSdtjesOInZbCGYvp8ksNo3vyCTz0SHvRW4ERmDGnLw6NPM_PJHzdnJiB4s0wSpp-Fkhrnl519gle62m9uammIdH3TVne4GNxwuhAPbY5F05oJQYCbuOXwnSeuOr3YEQ1TqJW5v3Iy2ohrib1WE4c0hUY95Wta629WIooNXzv-ZC4DMQcph4w7j9xfEpaXYqPxWcgdDcW_NjUeox6K1Es0iHZqUruSY3GdThD5IY4Uvnca8IAgik-T8wvtt0PlzT4B8PmzyF42yTVy7uR-0F90IvlPElrCTk3wzAhgqlVDxQ1RjJ9nad1-GfQzVX8jyoGO3jLzLsbWbDo-6UFml6iUn4X5q0A4wj5wgjNCPN3PWHy5BsG_k7dCvDWcDIJAuHJfCKBH1yN6Nl__h51ENnQYws__nuj_rfHKuiI1y-1M2IC9MNC6DGXVgNVbxiUsLjW7L3we9WkC1PdGP1Li_48WnEOBKZ7aZmVlapy_ZPqmUhIgH86D8O_an0SKYrgxrmLNJ3PHArTkkEBIhUfaD-U78jjTMS_0HM_tDvBbUVNianHKsOTzoQbspIQTdKrydm5OXUA32Wq6Xi4NEhAk82lc-C73DmeUX_slSXiws_aE3pl15ql6s5R4v8bFMvuqqe4nNEbZxbyhBZi0FZaux9wwuoxlVfxH6CBoVoSDG0XgiFwPppEv6D-oKwR-zD7xKZ5-tNvZuZz6IsVsShgIb2-rvH-QI185phtH3xOYnSk6VI-BEwSY9ud4yUGX8BRu4-beq3rktrVmJysuO-CFLbuJc9U08TbqfhEKcJ9oLi5LzgAHAMnjkQUGMfZd9xpH2mK10pX7QBDcQEgO1oj0LPOPvd_WUJ3tw9fdZEUzzpf0KV11AbgxcceAtR0Ih7Ubi9oaoTKmGmxQq44XYIED4wU2rLytT9uMGmCO0Sj8tEPr86Tg5Sq-YI6P91FzjnqsB114_GfNwfJ_qAEKui23kpN6XrTydrF7I-70_mvvUAux7hZJvTuQL-RPU9hSF9LvEpgC0txGN92S5e9WjHUjbY0fy4edhRMNaF4gbWMUu2B_kz0-VWa523k63ALRGwfD8pGPBZy6C6RgBIYdVDU3lpLnIbXeHPlnOvfrWEWqSmu9Sd4PKtskkBRfatgmo4Bimr5aohnjf8pzTHAPy5EloDzweYj-O8TUYDGGMJcr6n2ba-ZH3lSY4csUlb-feg8YJG5oKxvZyZ2WhPJjPr5SJ4a3xoW3UYcaMVuNepQJ7kpleDwSIdcSHv8cCRzXFUNoCwWIMIWd5UebK8eLpcLSisWP6PPsYVogdV6av5DDWeB0AF_4qzQtZeopeKP0bw9qsM-qsQ_pmSM8i4VYhz5gDIKHPt7gZdPfQk2fidUgBF5yOFMhJ-xPQqawF9XGXt6hohYyE9sqKuJmQxhdOwpW414StA7m5yKxhbNxNhBbEB3tu2JvwPjqNxW3ns-nktzQErhTCn8JrFWSlcACxzIykTIlUNExgC9WCDtKvbDEDzyNQlAzC9gKtk-DqEkwbs4ONyiLob6ADI6j8x8g3K7K8flo7f66VQMkiIMLD3OHS0idjs3Mjaj_GmB1Q5jy0sXuqATT1NIP9T3bMyZYNO284CQQ3z3qI1iPtam82YPBx72lKj6F1h15Rh4AA9Ew1-ZoMhhIomKofnWf4UGASedpF9uKTc7RgxGYqAgAuuTWqgpaeUuGPpzhFm77sOuOB52MR4IpBjmeDETmihPt4H3-Zkjm9370OTfLbnw60rRBF6cCqxpCdkHecH7MUvexbIayE_0MPXCcD7jXk1dclDO3Au5691UwcTBxlnjESijL28C55fTpetPSza5OcpgCZv7bOA82sFm4S9Yp_8yAn-XOB6_HvgMgcHBui6yQ90atR-85jww5UED7ywfEj5-MEvvF0n0rP1AfpRqnVPqEgJe2ufhp0PqFPoN9Og274d4Y3aiCuAnhhGOJJQI0_AkQWsM0M7PnaF5Qm69nhkYgOCD3s37rbeVraBCv-gxTqws8PPlaguNmQFIz_pk91ZFURL1DtJw_xyQ0El1pELLYDeYazXGCls587QqtGphNUXSszyVtiadtPy4Hwn8PUoooHElfm-KqchCRwgj_Ri1pH2CRYuyMJ3XTkOzcZqKnJZg0XebKMKZgio9dY47jF3i8oaivQqL3XsjE9fDimQAAlr7mow8tpJY4JIXlaRUg04EgvJBNvxVUktZmQwJL9Pye7RL9KZ5QNKTeck-KLnvkdbe8cGDa6-Qmghk0dxXw_NlbnJ7A-GMcE-GbYN2Peo2NDqIxnYEhtuYsmDjSUjWfpdxX6IX52sfpSbt9CJQiIFdvwsVVpvR8-Fk2bzoX5ry1DjfYGQdbU1V8Jz3qnuiTLhXalJ5iWr_zj2MgcqOAOAEwO0iy7sZW7MSDD3Ju0f5-D-8dPxcHjlSz21AoQwrtzEZzXhadS1hR5YLD84283Iqt4gXhlAfe_x4SOZsTNemSeZrU5SSPPJhn6ePLWwTZcX-dzRsCyHnMn9Noay-ZDkq9P5s5c7jUE4unCxltE1zVXadX9CgfO2fcbvUngJ7Mef2AAqUxw3Me4QOM9uHZKIniit4l3o_ociNPGL5u34eDFKdy7e67UWBiNF4_sBbfepE3zrRzcua0hhuk9VscoHabRoyCAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFdgAQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:58:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:58:19 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/ Frame 718D 27 KB
10 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8247e71c60f01cce914615568139113018a1a129dceb0fe0af55edb0211b8fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 11:57:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10545
x-xss-protection: 0
server: cafe
etag: 4672069523611413616
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Jul 2022 11:57:51 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DDF7 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 11:50:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87091
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Jul 2023 11:50:18 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 94ms
94ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022062701&jk=2227109324011451&bg=!CQqlCk7NAAaLlKKnq5Q7ACkAdvg8WvFWwWRaaEBEgnXgYYcakhJg9VG8t3BvuNhkzFaMpoOXD4BhmwIAAABIUgAAAANoAQeZApcrXOTZE6M2TNZVjESuJqjzLtuJKeMf1DTD7Cw0TIMGYVyy9OPqau4c4av65303ShcIvedCg7S-jlKhE1u9ewnOtnjkIrEeMaUO1yzunCgt6xW5C6r6Xwx2rlQHv5smj_4c_CZHTinGDTq6XVWBcGiCAnl498uNi01gAPUrpkiODPoJM9NwroYM8ThQMeU2v_vchOl-pJAXNOrrgGYzBc__GLVG4sih88jG0tqS6M4BmyQQf1wYijtb8izQhz8-9aj6-26nhwCF2aUpm4hR2JOYKMwgWM8lYzvG00B4LpS8cODQ7ync-Az8Qh70lBfpKeLsD8JLzTscF_BdjpQZNmQ_-o9Vc29_wqGtu24ydIBblssM4dxsIwzmim2Wpi4QEuSXjI6F1ysZbxiuGiaBGZS5ow0HSC9JOK4dgmhTEKms0OmsaJRobW2ZZ_l2MeUUS7ocR2sX6fksQz20o1_qOU1K5DpMkHKJn2Gc6BnWw4PsBrR76hOV43ZpgztUtFqMW1HwWqEYLKzPR79T92hEox1KXXVHtcxjk7e6BFZPut3xkX7-66GfkqH9a7ORDFDyEn3raUTkXwW8ZoWllU-MGcGlSDLcA6eFR_8Hsyp89i-NLNdFev4tN_V_kSHZmLnqwQKXo0c9hkAeC0G8-hk2gc3miPl16vMeBthAjyAddKRiuB23P6jwaFhMz_o3aQP__FJWHNwrXIJz2xrTPH-_DA3IeLP3KuNNdJlRLz4Acq9UcO5eWt_E4KXtchqOCMQkikiuaKR0jUr7BEiRPr_sjKHjDwExExvp3IWD7NOb0T5mDk1k6mcL67f9rzjB89CAD7YbjvReIzwNZjeU37ss4E0DAYP07EvCrVhm6-lu9m8j-gnoPYCE2hc
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A294 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 11:50:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87091
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Jul 2023 11:50:18 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D7E4 22 KB
8 KB 42ms
40ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 87090
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 11:50:19 GMT
expires: Tue, 04 Jul 2023 11:50:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 718D 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4547195bf628216dd6be228878c0248af05d88fc903283ef7abf59e4e8068cf

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1DEE 22 KB
8 KB 41ms
41ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 87090
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 11:50:19 GMT
expires: Tue, 04 Jul 2023 11:50:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BFA9 22 KB
8 KB 42ms
42ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 87090
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 11:50:19 GMT
expires: Tue, 04 Jul 2023 11:50:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js Show response
pagead2.googlesyndication.com/bg/ Frame D7E4 36 KB
14 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:28:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5618
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13869
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Jul 2023 10:28:11 GMT

GET
DATA 200
OK truncated
/ Frame DDF7 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73cb448ae383433cab87ba6dd690d4fa3794b14205f8e4054bdd8b6f616d570e

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame A294 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9450c6400978ecc97fe2db6d2c8415dd9f911a363f6c6773f58220f92e48f72

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js Show response
pagead2.googlesyndication.com/bg/ Frame 1DEE 36 KB
14 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:28:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5618
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13869
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Jul 2023 10:28:11 GMT

GET
H3 200 aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js Show response
pagead2.googlesyndication.com/bg/ Frame BFA9 36 KB
14 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:28:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5618
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13869
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Jul 2023 10:28:11 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 508 KB
47 KB 131ms
47ms Document
text/html 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d066567c4894a89e3e1c53ae1b803733f562e52b7c862977bad337b27b3fa9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 417943
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 48025
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 30 Jun 2022 15:56:06 GMT
expires: Fri, 30 Jun 2023 15:56:06 GMT
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame DDF7 0
110 B 190ms
86ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvySyMg7foJEcxBt1EUcJ4_oONPJudAmtgDQ7TAr_KHevZOpVrahjDih9kulThJlftSDfLP9D4Xuw8yhPfrndD61lRgaNSw6Himy471zKD1zXQRPzfIOyYm2ELQGn3WECqWcpuPHDtATXWMMZJAA_MCBM9dD2kqkXTveT8GieXQPLLXuzbNIEMm9Qfi7KDID6prVn5gnWXWmBHzwIKLR3tlWdbApIDS0FVfWh3Pad7VEkHjlitt8JX7lsdGy5t1uScDVr5K7oIz0F9mCqvBfQZOnYcBikOr3xOcGlEtccLSHXd6yLgKJdRcJIry56XWa5vz4z5c7RV2m2r9ov9Y9YseWGqFcrkS8itIaUB3de_IMLqmRwp4nZ8tEJYQ_8-gACuggBn0K23pbobNtDRVn8dxZo9AKT5s1KEHStqhZDC0TR04FDkoHAk_9plEY5iTFXgfQdLCapKuksHeoZtIjMomxksxH0i3ATkf7UWSKWzCpoXSedsmicWwYlVv7qoChs6TC-Qb8AmGDI6xLqjuM1F4ReGDn6SckvfCDLA1SlR-KWepbfhYx_oyTP2_50f_274-dScm5Ta7HeqwW28nE848_tszOBYU3xY7tN7XbI6-6Y8_xfjZ4VI7oxtzemEod5DFlSDUXMitBwpMdRmFkTie04M6yIYdaUdJdkHFsqdlhvKDHepRz9fLXV5wp3Go6U1z-cXdJcRNnhacBFHlhR-ZFZNtKFG5jCmNGir51IcFJeSH-dIbg9E-VhG0m-wccEhQ4NpDcBhlH63uH9FKpmb5xbaQ2It_ph7tAP4jK-z4fU4OKZ3z1Z_C6-MOqO_gsFsxp_KBmfFnUqH7x8m1i-95N-4rJFaN-JB76B5Gg7XTYswhHDXCQR0B1kKexDVwCcOa1XkEQhb2DiSzdykZMqyoj9qvHzrP3dagdinrB1QyMSksIjQWHRzelwbyeqAqe526b1CAG2tiC8yJCUmM_HNgHc7JpfgEaGR7a_ECt9NqoqQJiYp8XwVE15EtaYRT87hkt5Gb5b9JQFOSZnX78KIiTt-3nYl7PVPZqpP2FLjIexYHThmNDXSOiJyhVRc8CTxw1tuaijomBp0kw6-MAb93Gelv6jf8p7dOunvuyrN3ypP1Mx6JbHP4sHPK8wbK7ZFOmhYScRPpz2nvY-7RESUaflQf-nAPYrB-3NjRplMhvP-XXPVNp95tJwi_xJGXz4BXbAh9N5-Fagxry7CZSx5oKt2zHcgR9mV1YXfxDJtIimZqWr-QeW9BYUXvsAvQqUas2mm9aeqsmHRQDiyvxuPgj6icamWLOg&sai=AMfl-YRxhzfPNbkdzdHbHEtHkSYI-mG7nv19Nc13sCDgy_mh0GHrJVQEhV3UHIsDw9-x-Q3ZWW0mTUDJ9GZtpXsWZD7Uy97x8ti3Txb6gPEYHjOUuS8wsxy2A6kE5D-VaaDI_idHAcp6jlD71VbPTKjGiaiO_vrILysCYNDhiBzOxCZIWFDo5qNK8E1L2ClIdai2xsKxdF4cT1HUPWBw2Gm5-5uKlrhZgdRJh3tfFc6c&sig=Cg0ArKJSzB5RUcZ8mwjDEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=335&cbvp=1&cstd=332&cisv=r20220629.47049&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Tue, 05 Jul 2022 12:01:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 499 KB
40 KB 139ms
62ms Document
text/html 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c162bee0a486b89b14ba8c36863fb5a3360875b55d8709697d3ffa2952dbdea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 529392
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 40508
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Jun 2022 08:58:37 GMT
expires: Thu, 29 Jun 2023 08:58:37 GMT
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A294 0
64 B 194ms
97ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssFBHNLt3A4ZHE10iIYgr0Xu4rvQtxMtShkvpFQeqAXlYH185ZqX5NPrmSX7mNwjZeqLo4BuHCmH3sN9RES4oe2Rphs0lRyXyDrYdQpcGDfKsTLH-venAWxAxPdXFJWpCbMGW5dyN-KsTl-v_ov9g3OPyaCaCsh0eX3SR7yE8XGFkvlbexkh4DAKr7_GG0CNHTeNvCrQQ-VtQPmS7KwLHugRGvmvcqgjYi4k_R-geICu20-aj9TN9P0zexNLHjFodGMx_i68QfxNDc2s-uJI55Tw8GF0OWLD4Q_fenQbubVyEggnmcuey0cD7nkka8Qn_5Qt-uWZgaN9vqULESwhbpWxzPGdv7C6yXwFENx7jQh_E6M9yYGp4rf8Sq2xFuQa1G0czYoa9-mUYew8J8C9N1xPm7LkiQqKyu2BrkRgtHQbWi1dwZLpBWEDfTJnDrvPbvMiZra-vTnbJpGKWpm5L4F2wN0bVh6HLykIeZIwBnYHolKXsbT9A3JGRSIfxO4MxAMA_C2J9Rd1Fz2eIVk8I2uyuVwx8Mn0n4ohBW6RMuTUdtSSode1saftKjzpxpMacGEh03HYNxzWzOFhHy-3vYJHqS8wQFPsy3AHZp2ghFckKEif-Dtm6-dHNGVHQloYwwTvfcLX1u_Nq3utkgGP6iRNnd2WDkKR_OqcuvoqwdtjUrrsdcDCcF9Zm2Wqdq7HTJF9IPMWI2rhoXn6UdvFuxUAN0REGDjI6_aNA-9vAg5VEA9fNmFpMZQtzhlk91TY-agFJPInoodWwZsDTnAAjnElgTVe3jy27KXijXGdImerQrQX0nwPBQ4oRWFyHmxQ3d7OSkZhRGM-TBarbyk6pWCbGWNfXMTB9Dfumc9jDclKDc97gmAkKxnN-od2SZO0IxhnhPGtUQFqnjZ7Ysj-evJ0hp-B28kjwTU61tDcQY1-OTY3dd25NiwhpQUTF9pVeQCEB71FB3I1lGH3Nc_4OYxHJeJlP6nsOT-2sqaCLWzcF_QJNOYT7EYoE_bCZBHmOzT_cg9vQtsqsPSOUJ6EdQ25RELz-LSUljx6wbyNiNfmXexHa9RYT2a7hBhznPlXukkmRKPDeYlEX2sMEZceOV6Zqs54nfNejjjCJ2gv9DzJTSRP5xOMC7yMm_crYjukJp5UpD3c4W1BcLQoICXL4lYOCNXPnKdGFMLbikRtu-zicXdF0O38tQ_Fn7CokFTodH2PCd_SjcbhgrycGPvj_SmoFBE2gQDNry4TpyLX6937Hv7_MhAj3pI9XtNzMRFwWhkbfekpiv-2uiqPQE6JCXcgMctk7-P&sai=AMfl-YS-ft5oHU3A7FRdOJuEmbiSN8rlPM6DCy6wVAC7rX8VyVmqDez8huGsEfEQtukys37gcUFyGcX5l9GvzmkdGe-foiKkXjVrxwVWaQJU1h7pWReqEVqZ4LKITRNCdow5SNIty78MtbkaqNS08_vhSIJidXpAqu8kLjt5446IJwHHRZSmx4gflB2CP-9caGmoUifKf9wIuVkIEb_bJLRFuzjkCoGiK8GUfjV3qF3l&sig=Cg0ArKJSzCJCJZ79Kd0GEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=309&cbvp=1&cstd=307&cisv=r20220629.68951&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Tue, 05 Jul 2022 12:01:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15445976291598551038/ Frame 8372 28 KB
5 KB 125ms
56ms Document
text/html 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96a062a2e70af3f05d954475b77f1f1c5c0f2276bf0a4eb06111f9f8ed488279

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 78887
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4945
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 14:07:02 GMT
expires: Tue, 04 Jul 2023 14:07:02 GMT
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 718D 0
575 B 170ms
81ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst0UkTdxgbHxcCZq9mxXt8SI6qdcsl-bHFBSIdgjqSt-LtH-3amH8rxVp-PAjDikh6T_eGTHsHeWzFd_rUTt-P1nnly3ouCqqzZwZ0007WvEWvLAJV9nn0uuIQQxCb5_Kzr4IiaFiOZNoJRoU4Nvd24oT7Anguy&sai=AMfl-YT9kGikSRdKH4oDzEmab-fxXbRtZhHnL-uaTFHNJ8biV3odJgs0teGAfjTGCLZw4K9pbuL-Mm3CdleWvIhnSWYjt4FUMZDDtm_u6XolYAXJOPwH0GXnMLq579M9&sig=Cg0ArKJSzAjs8JqPyoGxEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=294&cbvp=1&cstd=291&cisv=r20220629.44942&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-143-204-215-88.fra53.r.cloudfront.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jul 2022 12:01:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 ca
choices.truste.com/ Frame 718D 27 KB
27 KB 49ms
47ms Image
text/javascript 143.204.215.88
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont2&w=300&h=250

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.88 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' ; prefetch-src 'self' ;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 09:35:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8792
cross-origin-embedder-policy: unsafe-none
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding, Origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
x-frame-options: SAMEORIGIN
expect-ct: max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript;charset=UTF-8
via: 1.1 15d3b4db3728feaae1780610a1bac86e.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: kXDCksxuPu6BjtXtEQs_Nk_cupJzbAq5fPeeBdO9-73_oikD3ISAAg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 8cfaba76796d399b9506c3f6085d3edc.js Show response
s0.2mdn.net/sadbundle/15445976291598551038/ Frame 8372 77 KB
20 KB 44ms
43ms Script
application/x-javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/8cfaba76796d399b9506c3f6085d3edc.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75e5ea6fdc75316b66f43479cbcd3201d0e1709187b377ff8391ddd665394938

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 15:10:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161460
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20174
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 15:10:49 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame C849 29 KB
10 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 07:55:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14807
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Jul 2022 07:55:02 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame A0AF 29 KB
10 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 07:55:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14807
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Jul 2022 07:55:02 GMT

GET
H3 200 VolvoNovum-Medium.woff2
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 38 KB
38 KB 43ms
42ms Font
font/woff2 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/VolvoNovum-Medium.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2675ab1d1852f1aa30e272d7c2b1b9616e1f4771a94860e0d92bc7fca6c3c48a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
Origin: https://s0.2mdn.net
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:30:44 GMT
x-content-type-options: nosniff
age: 423065
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39068
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:30:44 GMT

GET
H3 200 93eae8d0292c4d3726bf3c47bf51c36f.jpg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 48 KB
48 KB 45ms
44ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/93eae8d0292c4d3726bf3c47bf51c36f.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a21bddd2acb65fd0524d45a2d0256d50b9890769eef4506fa0deb4a0f9c95956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 29 Jun 2022 10:00:02 GMT
x-content-type-options: nosniff
age: 525707
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49020
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Jun 2023 10:00:02 GMT

GET
H3 200 3eb52ccc115648988d8a0f91f9b200ec.svg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 2 KB
807 B 80ms
78ms Image
image/svg+xml 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/3eb52ccc115648988d8a0f91f9b200ec.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5c2de064417389b2a1262a51574b1d19ce2ad5c6d630e0b069cec03ab7dee56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 15:10:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161460
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 778
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 15:10:49 GMT

GET
H3 200 7f29854a10f620126f269c03eebce7c6.svg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 2 KB
767 B 53ms
51ms Image
image/svg+xml 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/7f29854a10f620126f269c03eebce7c6.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2254cebf5de7f3393361279797806e4ae09707478cf471ca7e8f761f9831e619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 14:14:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596867
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 28 Jun 2023 14:14:02 GMT

GET
H3 200 7c886a930438695e154cca17c0d35acc.svg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 1 KB
584 B 78ms
77ms Image
image/svg+xml 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/7c886a930438695e154cca17c0d35acc.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6935ba2102fb5b4ed9660ce68443944b76235e31781fafc098d14d6fc07d3923

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 15:10:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161460
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 555
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 15:10:49 GMT

GET
H3 200 4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 5 KB
2 KB 51ms
49ms Image
image/svg+xml 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9fc98a5f2ad3fade2176c7f4d057c02a332ee5d3e532746414eda6e88bc46ae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 15:10:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161460
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1881
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 15:10:49 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D7E4 0
20 B 96ms
95ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BIS-3LSjEYsfDDPeLjuwPwtWvEAAAAAA4AeAEAg&bg=!oKOlo-fNAAaLlKKnq5Q7ACkAdvg8WvfpLMYQaRBAssq0U8yCWaNKrIVsLdvnu6yuqo0CTyQH_47XswIAAAFIUgAAAANoAQeZAu-x4976-yOYboc99F-f3wsMlRTDQixntzA59bcrIqUTBBHGdReANjn2kTMg-2EHfEaTf8riOIX46p8ByycR-Dmg9BWEhgn28BCuO_7nRbZrmWwAE3drJJBaNrY_DLHvLzeUjcodU7B76szAOrPsldT8bH5g1DggPj_q2RxAJztist_INmX_nVTGhHvZQBzCmLmyJ2z2AvKdEr75AfmmkfY0jPsdzkFSTroUJJBAh-Kje-kFlgggJ1hC3nZt6PU4Cg_0-Kp3N8RuWOloxEJygB7UcKnTZjPEs0bvQH2i5aRHcjmN1ssm6EN5ePZ04y4p2GjtCdMELKy28U70F97SayGybqDq0ZhboetRwuRctU6KdqhxrMooKaJab5FsAtXmL5QI71kPCi7SRYZadketH3-euWIof-CI8aSWB_J2UDAJq7gB0tNmH0doBAPTupFRSOsTKLug2fyUSwja3gojCRGs-R92Qis-dEk19pAs8dSIc902IXVgdtxfbomhRXyl8S-6ftC29-ZiurjBQaQ4LERts4M_v8StZTDGB0x55RdTj6e2NaKZZDEc6bVjJBjLZa_CQgaXcUW6H4Vy2fjpnuV0tCZF2FYQcE6tHTxq1fXfh-OtAADaIF5m9fG4Kk6cU24bCbQAX9vFDBkF4kWLkPR7jM7yVfuFwtoj8tp6ovpmBfDcvD2qCsYzlSNtPQYbnSRYroaQc6up1GbwOtX11SFOuKRHBBRMsGX-qGLyjdPgLnEkrmBsu3MR7GIuG-tPHga9glyYe1TEGExcDytCDXxirMz441yJIWnB8vRH3E_uU5qFOPL2Jw4sj2al5YUtp4uPgKv_fdYHvvZTdQrrQlgd1L02QUl4f-qQJuhYfTmE7AJ8ENfzq9RiCVGcjBzEqu1_gC-V28TKsRnr2xJOWpJe2d0Ck6hU_xUi_vq_lliBDZyu1vFW5Mp16OZ0x9rTyL_6MAsGent9Nl8XNrVlYLTp2OaD_ClJyf-5HiSb5_b2

Requested by

Host: 9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com
URL: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 VolvoNovum-Medium.woff2
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 38 KB
38 KB 64ms
64ms Font
font/woff2 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/VolvoNovum-Medium.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2675ab1d1852f1aa30e272d7c2b1b9616e1f4771a94860e0d92bc7fca6c3c48a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
Origin: https://s0.2mdn.net
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:52:48 GMT
x-content-type-options: nosniff
age: 421741
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39068
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:52:48 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A294 0
26 B 192ms
79ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssFBHNLt3A4ZHE10iIYgr0Xu4rvQtxMtShkvpFQeqAXlYH185ZqX5NPrmSX7mNwjZeqLo4BuHCmH3sN9RES4oe2Rphs0lRyXyDrYdQpcGDfKsTLH-venAWxAxPdXFJWpCbMGW5dyN-KsTl-v_ov9g3OPyaCaCsh0eX3SR7yE8XGFkvlbexkh4DAKr7_GG0CNHTeNvCrQQ-VtQPmS7KwLHugRGvmvcqgjYi4k_R-geICu20-aj9TN9P0zexNLHjFodGMx_i68QfxNDc2s-uJI55Tw8GF0OWLD4Q_fenQbubVyEggnmcuey0cD7nkka8Qn_5Qt-uWZgaN9vqULESwhbpWxzPGdv7C6yXwFENx7jQh_E6M9yYGp4rf8Sq2xFuQa1G0czYoa9-mUYew8J8C9N1xPm7LkiQqKyu2BrkRgtHQbWi1dwZLpBWEDfTJnDrvPbvMiZra-vTnbJpGKWpm5L4F2wN0bVh6HLykIeZIwBnYHolKXsbT9A3JGRSIfxO4MxAMA_C2J9Rd1Fz2eIVk8I2uyuVwx8Mn0n4ohBW6RMuTUdtSSode1saftKjzpxpMacGEh03HYNxzWzOFhHy-3vYJHqS8wQFPsy3AHZp2ghFckKEif-Dtm6-dHNGVHQloYwwTvfcLX1u_Nq3utkgGP6iRNnd2WDkKR_OqcuvoqwdtjUrrsdcDCcF9Zm2Wqdq7HTJF9IPMWI2rhoXn6UdvFuxUAN0REGDjI6_aNA-9vAg5VEA9fNmFpMZQtzhlk91TY-agFJPInoodWwZsDTnAAjnElgTVe3jy27KXijXGdImerQrQX0nwPBQ4oRWFyHmxQ3d7OSkZhRGM-TBarbyk6pWCbGWNfXMTB9Dfumc9jDclKDc97gmAkKxnN-od2SZO0IxhnhPGtUQFqnjZ7Ysj-evJ0hp-B28kjwTU61tDcQY1-OTY3dd25NiwhpQUTF9pVeQCEB71FB3I1lGH3Nc_4OYxHJeJlP6nsOT-2sqaCLWzcF_QJNOYT7EYoE_bCZBHmOzT_cg9vQtsqsPSOUJ6EdQ25RELz-LSUljx6wbyNiNfmXexHa9RYT2a7hBhznPlXukkmRKPDeYlEX2sMEZceOV6Zqs54nfNejjjCJ2gv9DzJTSRP5xOMC7yMm_crYjukJp5UpD3c4W1BcLQoICXL4lYOCNXPnKdGFMLbikRtu-zicXdF0O38tQ_Fn7CokFTodH2PCd_SjcbhgrycGPvj_SmoFBE2gQDNry4TpyLX6937Hv7_MhAj3pI9XtNzMRFwWhkbfekpiv-2uiqPQE6JCXcgMctk7-P&sai=AMfl-YS-ft5oHU3A7FRdOJuEmbiSN8rlPM6DCy6wVAC7rX8VyVmqDez8huGsEfEQtukys37gcUFyGcX5l9GvzmkdGe-foiKkXjVrxwVWaQJU1h7pWReqEVqZ4LKITRNCdow5SNIty78MtbkaqNS08_vhSIJidXpAqu8kLjt5446IJwHHRZSmx4gflB2CP-9caGmoUifKf9wIuVkIEb_bJLRFuzjkCoGiK8GUfjV3qF3l&sig=Cg0ArKJSzCJCJZ79Kd0GEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=746&vt=11&dtpt=437&dett=3&cstd=307&cisv=r20220629.68951&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jul 2022 12:01:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DDF7 0
26 B 167ms
80ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvySyMg7foJEcxBt1EUcJ4_oONPJudAmtgDQ7TAr_KHevZOpVrahjDih9kulThJlftSDfLP9D4Xuw8yhPfrndD61lRgaNSw6Himy471zKD1zXQRPzfIOyYm2ELQGn3WECqWcpuPHDtATXWMMZJAA_MCBM9dD2kqkXTveT8GieXQPLLXuzbNIEMm9Qfi7KDID6prVn5gnWXWmBHzwIKLR3tlWdbApIDS0FVfWh3Pad7VEkHjlitt8JX7lsdGy5t1uScDVr5K7oIz0F9mCqvBfQZOnYcBikOr3xOcGlEtccLSHXd6yLgKJdRcJIry56XWa5vz4z5c7RV2m2r9ov9Y9YseWGqFcrkS8itIaUB3de_IMLqmRwp4nZ8tEJYQ_8-gACuggBn0K23pbobNtDRVn8dxZo9AKT5s1KEHStqhZDC0TR04FDkoHAk_9plEY5iTFXgfQdLCapKuksHeoZtIjMomxksxH0i3ATkf7UWSKWzCpoXSedsmicWwYlVv7qoChs6TC-Qb8AmGDI6xLqjuM1F4ReGDn6SckvfCDLA1SlR-KWepbfhYx_oyTP2_50f_274-dScm5Ta7HeqwW28nE848_tszOBYU3xY7tN7XbI6-6Y8_xfjZ4VI7oxtzemEod5DFlSDUXMitBwpMdRmFkTie04M6yIYdaUdJdkHFsqdlhvKDHepRz9fLXV5wp3Go6U1z-cXdJcRNnhacBFHlhR-ZFZNtKFG5jCmNGir51IcFJeSH-dIbg9E-VhG0m-wccEhQ4NpDcBhlH63uH9FKpmb5xbaQ2It_ph7tAP4jK-z4fU4OKZ3z1Z_C6-MOqO_gsFsxp_KBmfFnUqH7x8m1i-95N-4rJFaN-JB76B5Gg7XTYswhHDXCQR0B1kKexDVwCcOa1XkEQhb2DiSzdykZMqyoj9qvHzrP3dagdinrB1QyMSksIjQWHRzelwbyeqAqe526b1CAG2tiC8yJCUmM_HNgHc7JpfgEaGR7a_ECt9NqoqQJiYp8XwVE15EtaYRT87hkt5Gb5b9JQFOSZnX78KIiTt-3nYl7PVPZqpP2FLjIexYHThmNDXSOiJyhVRc8CTxw1tuaijomBp0kw6-MAb93Gelv6jf8p7dOunvuyrN3ypP1Mx6JbHP4sHPK8wbK7ZFOmhYScRPpz2nvY-7RESUaflQf-nAPYrB-3NjRplMhvP-XXPVNp95tJwi_xJGXz4BXbAh9N5-Fagxry7CZSx5oKt2zHcgR9mV1YXfxDJtIimZqWr-QeW9BYUXvsAvQqUas2mm9aeqsmHRQDiyvxuPgj6icamWLOg&sai=AMfl-YRxhzfPNbkdzdHbHEtHkSYI-mG7nv19Nc13sCDgy_mh0GHrJVQEhV3UHIsDw9-x-Q3ZWW0mTUDJ9GZtpXsWZD7Uy97x8ti3Txb6gPEYHjOUuS8wsxy2A6kE5D-VaaDI_idHAcp6jlD71VbPTKjGiaiO_vrILysCYNDhiBzOxCZIWFDo5qNK8E1L2ClIdai2xsKxdF4cT1HUPWBw2Gm5-5uKlrhZgdRJh3tfFc6c&sig=Cg0ArKJSzB5RUcZ8mwjDEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=808&vt=11&dtpt=473&dett=3&cstd=332&cisv=r20220629.47049&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jul 2022 12:01:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Volvo_Black.png
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 5 KB
5 KB 46ms
45ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/Volvo_Black.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5be30616d437d2baf9041a6648598542ae30fed30d261b002266e5d58969685

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:33:00 GMT
x-content-type-options: nosniff
age: 422930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4824
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:33:00 GMT

GET
H3 200 icon3.png
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 29 KB
29 KB 58ms
56ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/icon3.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51296d61497876b8cf13f57f6c6d92af6a4d2ac3645f8bf59b633133b3d8c0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:44:43 GMT
x-content-type-options: nosniff
age: 422227
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29274
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:44:43 GMT

GET
H3 200 icon2.png
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 23 KB
23 KB 53ms
51ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/icon2.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9b221c6be6087a312ae85a590c3c1c4a070e68e02048725b649b58884860625

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:33:00 GMT
x-content-type-options: nosniff
age: 422930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23049
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:33:00 GMT

GET
H3 200 icon1.png
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 14 KB
14 KB 50ms
49ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/icon1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02e763cf1b2b78cc8ae7f6cb99afe6660ecaeaeb3bb83d3641faae8fa9e061f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 29 Jun 2022 08:58:38 GMT
x-content-type-options: nosniff
age: 529392
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14415
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Jun 2023 08:58:38 GMT

GET
H3 200 image3.jpg
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 51 KB
51 KB 74ms
72ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/image3.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52d14a865c98b96488d22df2dcacae4454c1e0a382e65a0156c3f8e1af74d0a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:33:00 GMT
x-content-type-options: nosniff
age: 422930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51912
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:33:00 GMT

GET
H3 200 image2.jpg
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 36 KB
36 KB 47ms
46ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/image2.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3706372cdba21ffa2b7c9e2eca6e2c60be5260a5600cc8183a0a61d5927a56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:33:00 GMT
x-content-type-options: nosniff
age: 422930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36529
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:33:00 GMT

GET
H3 200 image1.jpg
s0.2mdn.net/sadbundle/12477638262967500800/ Frame C849 36 KB
36 KB 64ms
63ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12477638262967500800/image1.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ced05fb267fccd2c83da1c09defe17b3319783ac50fbc3096cee51dfa70ad161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12477638262967500800/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:33:00 GMT
x-content-type-options: nosniff
age: 422930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36435
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 14:18:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:33:00 GMT

GET
H3 200 bc712d21ad9edfe1474787e70d5dba17.svg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 1007 B
590 B 144ms
144ms Image
image/svg+xml 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/bc712d21ad9edfe1474787e70d5dba17.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6405f38dea688ca5d04af27bb0d2ff4f90c3a504177afacf082775b5615d9f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 29 Jun 2022 10:00:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 525708
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 553
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Jun 2023 10:00:02 GMT

GET
H3 200 23408a27f7227869b526ae2f14c97ddd.svg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 957 B
565 B 146ms
146ms Image
image/svg+xml 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/23408a27f7227869b526ae2f14c97ddd.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f85f20a5e3b281326141ad25c185aabaf5fbb9014f912c769d0a3c410e444ef1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 15:10:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161461
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 527
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Jul 2023 15:10:49 GMT

GET
H3 200 86f34087b5766269f4a51b241187d4fe.svg
s0.2mdn.net/sadbundle/15445976291598551038/media/ Frame 8372 2 KB
771 B 145ms
145ms Image
image/svg+xml 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15445976291598551038/media/86f34087b5766269f4a51b241187d4fe.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d74361251421a324cac8657dccd8d5879d7672b07ef077dc54f53618a8df8778

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15445976291598551038/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 16:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 241755
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 733
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 21:00:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jul 2023 16:52:35 GMT

GET
H3 200 Volvo_White.png
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 5 KB
5 KB 145ms
143ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/Volvo_White.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a584e2fdcda4adee84916ff47e3fe5a50ea99304accfb44c0cec955e99eeb15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:52:48 GMT
x-content-type-options: nosniff
age: 421742
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4972
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:52:48 GMT

GET
H3 200 icon3.png
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 29 KB
29 KB 151ms
149ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/icon3.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a73df65a0fa03e359d59f2422b6c464e67c8ad2eab7ac6895ece309cf4a4730

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 28 Jun 2022 22:21:54 GMT
x-content-type-options: nosniff
age: 567596
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29445
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 28 Jun 2023 22:21:54 GMT

GET
H3 200 icon2.png
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 51 KB
51 KB 150ms
148ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/icon2.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdfef5bdc12edcf41579130a794d409f346cbdbc014e23df96928641917d771a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:52:48 GMT
x-content-type-options: nosniff
age: 421742
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52546
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:52:48 GMT

GET
H3 200 icon1.png
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 80 KB
80 KB 147ms
146ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/icon1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91268344ff0b5227c19f3ca0f95c9030afeb9cc8def079f6272d817053f375b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:52:48 GMT
x-content-type-options: nosniff
age: 421742
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81798
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:52:48 GMT

GET
H3 200 image3.jpg
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 74 KB
74 KB 72ms
71ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/image3.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7957066859b6da5d1b065600e921126c2981db53652908f21652c6e2a33928b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:52:48 GMT
x-content-type-options: nosniff
age: 421742
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75392
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:52:48 GMT

GET
H3 200 image2.jpg
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 78 KB
78 KB 67ms
66ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/image2.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6fec57f620cc83059be3c1523d23818f029304d6929cb05b515e4327dc91193

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 11:50:59 GMT
x-content-type-options: nosniff
age: 87051
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80030
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jul 2023 11:50:59 GMT

GET
H3 200 image1.jpg
s0.2mdn.net/sadbundle/15563021547256938496/ Frame A0AF 122 KB
122 KB 58ms
57ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15563021547256938496/image1.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941035fbecb566ed586708b1c0c7259ee6ab02c6f4a66f6b780c18bd2050bd31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15563021547256938496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 14:52:48 GMT
x-content-type-options: nosniff
age: 421742
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124601
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 17:43:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 14:52:48 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1DEE 0
20 B 77ms
76ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BcBemLSjEYpaZCoSJlQf80Zv4BAAAAAA4AeAEAg&bg=!Pj2lPXnNAAaLlKKnq5Q7ACkAdvg8WhjnlA_yu3xKNOUhd_qZ1rbNEMFspCgqeHr5mnhv_L5V6ChsMAIAAAHPUgAAAANoAQcKAJAUne7-jNF6w65UuEEHCT2c5WzbS8T27Q_qwUoeJJ4DJWkvZRZhAsxr879u8gyU0grADPcYIC_ea11UAW2910vHC1r0Q9R1VAanlkck2GvS5gEMgKfC83PS79oPW8neriEPkKKg_AD6dFXaXlAwQQOPXDuuYEHDRyAtvem-9OJDgTD6aeyKg-PEguwP80Q38jiZAtjufVjFMufaUEibsyfvYoXBiKMUZFSlUB5WSN5HL6B7Jt9KZNoaeLZOZljAYjQGgrRUidp3gbcebQwKuQIFW4nhb9GMjOmN-3-Y8ziQu1M49v1AcCjC0qYa-f_dG9XxhmxdKljLPBb1tddkysPF5A3ExZikB7E6iJePP8q5DAzbe2L04eJZVvyaFVto7UsAD4KpoVqXCcaD2DBmjC1ABcPOiE4hTwMEQVdCcI7o3CUNq5LznxZ-64nN7YS2pvT8D6iiVRV1MpcS3lpuRucyM_T-zDXKNsq2VmhuDqHXhpHpPSWM97PHH52sYaVbZBQvK7HKEfDmjDpU47JBtRG9j2PJVXpPt0cSkXEdEvVsjNLP92dKa9l0b5hJCu6GOXdF9KOdUCi57aQraIVoHkjvycqg6fB4gWFXMOG9NCdBUmVo_VqYfyHNR0m-3qOzWjsP7unWHUWkpN5K67-njVeM3jTlQWHenPcvf5SAPtpjp11JZClksj61CZTfgW79n-A-MDrFz1SBcaiOANj7fv6Y074VpcKr_FxGEeuw5Ymg6bkqa-6qOFkAPoViRUfrfyerE6Pzayrrej1BRk3WtU6eRHlY5lc2kNyuBZ18Rgxk_F8nFkDIKZHi6ULXwoAt2Gd7ZIQMCViNliRKxiIOsrFZOO1Ncb3qUvrUtCOjkrur5vpazvrAm2lyrPBt3atEah0BSJSHiBPzj8gggffGl99FKjhxiiUhXwiBDBgUgN6jH93NH0pq0Aig79JLGK98WmvRCitvRVsqqvFESekZOoQ0B_BlYVPJWqKbtZFDoEXWraLBmxu7dj_XdxLbC04Jg4Uf4JkCBXifhLjQrKbs36TDIAkaGPg98grEAbYvi8TZm9Sw8ViozwNFTERn-svFA7K3owh7zNUWki2tCG6WZukxsfXFBRP-8AUGlNzov7xjWZDnxiHIS-AnprUyV2bgTFDfhlqlrx8a1Xxbzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BFA9 0
20 B 79ms
79ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bc3QwLSjEYsWgCqiA7_UPgsWb8AkAAAAAOAHgBAI&bg=!ZmWlZSHNAAaLlKKnq5Q7ACkAdvg8Wmed95lZV6Y0NXP_x325icLJbvx_BJLyAC08dc70MN98RTO8AgIAAAIgUgAAAAJoAQeZAuVh8sB9tpuzQHOCotYLPRNbhlfoIALxMVuR3arXnP141gxwtovEppUSRWX0jEFzkN5ukJUxWwQbgUJaFMjSolRt9M1vffLry0qy_hgqw4ufSHpA1ortdwzbdHviDVUvByKS_SH8j1X_K_osG8KktQm7yrA3RUwWL9zPyUf1iBrS2LcX4cf8mI2irfnPmsrZHn90N0AT_N3yXCibodzQPA4a46lw5DNlh2a9BUBP6RT8UAwp3erRDx5M9GKkcmpcCelzrnxpAVOhNfuoAZvXtqII4Um9zAjwg-hCJ2u5NC1WzdJaAw-leH3Vzi1n398YOoZxqtFThckCeksMOk0c3YtWfa6D6LEd2qGch4yN9O5qWRF6j0TlG2tm2wj3PAT4ronHZjAJ46tCoBXTzwmS-F0Qc9SMrm_2b8k_ls8YtXAIeBUkRt_KkVCrBnSl9jtVX8W76_nhtltjfa-eSK1Pctbvd5SgckCWD3Xb8BSNAwmurg1mKOhJiHccjDmeFek4jfmHYnBWrd4mfj2Ns7MG4hQQLgYolTkpii4kTXgZpzZ-d1pagENG4ma0_cm9Axi-EU-hMnURd98Zf42zPZi7Ou-RTtl0anuqhwolGfx1-d3z6j0_P417GLrM9EVE05WMkqiU_5PSX5ij_95yx7sAIHtrm4RcXMZNIUh_6FQWOO5g4uvLym-PrOIBaAaKz5qMKL-3r_qTXq_cFDqUIWyj2VG_Xd3IQJJZsKsNl-mHhnufvVizdUTZpB6ZHEWOnEpRK8i7iuMYjW6Zhjbts13hRokBsZS2pp_JLRz4YuQt_E4dqH-eCOr7H8wRXTlWiAVFwe5JPIR43105xqzYSf0FhtHu2SSso5ebO2N_9eC_AwR2-UTvdiYTHfS2nJnxRxOcFIEruHQRdGuRRHK_UmwDDogh8azFkXqNDZxOaRj15xhEpVlApjvPbIVovpz-Ydeq6UC7jABgYj59_bKSkaaltFWJ8vJOD1w

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 718D 0
26 B 82ms
81ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst0UkTdxgbHxcCZq9mxXt8SI6qdcsl-bHFBSIdgjqSt-LtH-3amH8rxVp-PAjDikh6T_eGTHsHeWzFd_rUTt-P1nnly3ouCqqzZwZ0007WvEWvLAJV9nn0uuIQQxCb5_Kzr4IiaFiOZNoJRoU4Nvd24oT7Anguy&sai=AMfl-YT9kGikSRdKH4oDzEmab-fxXbRtZhHnL-uaTFHNJ8biV3odJgs0teGAfjTGCLZw4K9pbuL-Mm3CdleWvIhnSWYjt4FUMZDDtm_u6XolYAXJOPwH0GXnMLq579M9&sig=Cg0ArKJSzAjs8JqPyoGxEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1116&vt=11&dtpt=822&dett=3&cstd=291&cisv=r20220629.44942&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: naslovi.net
URL: https://naslovi.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-99-86-4-38.fra6.r.cloudfront.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jul 2022 12:01:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 194ms
61ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:50 GMT
content-encoding: gzip
last-modified: Wed, 29 Dec 2021 12:30:46 GMT
server: nginx
etag: W/"61cc54f6-15c19"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 06 Jul 2022 12:01:50 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DDF7 42 B
64 B 166ms
77ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuQD_CdUPL-u2No6MXAsq-19QZDY3jNUPbTGg44DllxM35V1uwRd4k8YetZUBdjAk3uJKkPLc-Nk0KhGbKnlM6CzZiYGU5qV6dNBBWLFPXHAuwo6dvLszekKevwAmqw1reb-4ZfRA&sai=AMfl-YTD4fr13IH9L4urizdkoSktczD-CS7Hsgtd-9sU8qNg3NcbJOrDZeBm9JLbplvbO_1MnAxXVjl_PC4mtIXPdVCc6iUjwZo8qTO6IFNoVA&sig=Cg0ArKJSzNprPZ8w4V3GEAE&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&id=lidar2&mcvt=1062&p=257,976,507,1276&mtos=1062,1062,1062,1062,1062&tos=1062,0,0,0,0&v=20220627&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2973301163&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1657022508892&rpt=593&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A294 42 B
64 B 160ms
75ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssT8yKdFLBdGlqE4jkDt7s8ac6B1BblQgvMENzqx35iQ91rAUI7nk1DaO3y_tKYXdRv6DhkJuuqBmvM2hbgg7nV1MEH2GtPb7UaMGUVwvr2mNRFn_iUI4oFRXnSPLjUypA47rwxYA&sai=AMfl-YSgVupN19cMIeqrhhQz-CtvLXLYjQIUKLVSUelaSVBME8lggVbwtRtd3BCvlY6OWgiMwR4syvL_HREvBQEoxdIITVn_F31FjxFIBJcdyg&sig=Cg0ArKJSzLrtmFo-rz0mEAE&cid=CAQSLgCNIrLMy_X4mNtO_X2Ojx19_2mYSNC8Zv2_BgAtryQkK_bzLNqB7PHPN68iYFc&id=lidar2&mcvt=1037&p=152,440,242,1168&mtos=1037,1037,1037,1037,1037&tos=1037,0,0,0,0&v=20220627&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1402964911&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1657022508895&rpt=614&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 5004 15 KB
6 KB 170ms
56ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=naslovi.net

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

5e5c9149be229df7c934f8cd1acf1b3cc9e04e29cbbe6cbe0e2d726e79930cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-length: 6144
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 05 Jul 2022 12:01:49 GMT
server-processing-duration-in-ticks: 2417
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 178ms
60ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0413c66952464f1ecd016f7bcaab521634a380fc3f9b1b907caa11cb70c2ebc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://naslovi.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:50 GMT
content-encoding: gzip
last-modified: Tue, 03 May 2022 11:21:00 GMT
server: nginx
etag: W/"6271101c-15b58"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 06 Jul 2022 12:01:50 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 5004
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=naslovi.net&sn=ChromeSyncframe&so=0&topUrl=naslovi.net&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=TfVuEnxNeUZKYjZvSTB4SnpodnFZZzE3aTVEazlta1Z3Y2tNTjgxcVlpUFVyT28yZUI0M21McVdZcHJoUThoZW8wVS9mRWZZWGtMTCthbCtEM0ltcVIxSDZJUnpTSGFBTmhlME9QL2toOXZjZGFSZDRJWGxOcFg5dTN6QT...

425 B
634 B

122ms
37ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=TfVuEnxNeUZKYjZvSTB4SnpodnFZZzE3aTVEazlta1Z3Y2tNTjgxcVlpUFVyT28yZUI0M21McVdZcHJoUThoZW8wVS9mRWZZWGtMTCthbCtEM0ltcVIxSDZJUnpTSGFBTmhlME9QL2toOXZjZGFSZDRJWGxOcFg5dTN6QTBqb293ejdUVWVwdVR3RUhXQXNhRkVQSlJsbWxUeTFqUDFPZVJxY2h3bWxDV1NaMWJES3lGVElBMWZjNzE0dDRvVnpic3ZCOElKMHdnbWIveWhqa2UwSkpuRFlFQWxMUThmaEpLeUdENTl6NVhvV3hDS2ZvTTU2NTN3TDNQaWlxZFVVcVRITWRUNGRPRndtOUtkeUxUbDZKdHVDWFJCdz09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

8fcba688506207ac4ac7316442ce955f742c2858216b253b55591b80ab35d252

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:50 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 4508
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:50 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=TfVuEnxNeUZKYjZvSTB4SnpodnFZZzE3aTVEazlta1Z3Y2tNTjgxcVlpUFVyT28yZUI0M21McVdZcHJoUThoZW8wVS9mRWZZWGtMTCthbCtEM0ltcVIxSDZJUnpTSGFBTmhlME9QL2toOXZjZGFSZDRJWGxOcFg5dTN6QTBqb293ejdUVWVwdVR3RUhXQXNhRkVQSlJsbWxUeTFqUDFPZVJxY2h3bWxDV1NaMWJES3lGVElBMWZjNzE0dDRvVnpic3ZCOElKMHdnbWIveWhqa2UwSkpuRFlFQWxMUThmaEpLeUdENTl6NVhvV3hDS2ZvTTU2NTN3TDNQaWlxZFVVcVRITWRUNGRPRndtOUtkeUxUbDZKdHVDWFJCdz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1582
content-length: 541
expires: 0

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 811E 281 B
554 B 142ms
45ms Document
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 05 Jul 2022 12:01:51 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 index.html Show response
cdn.districtm.io/ids/ Frame FDBA 116 B
430 B 135ms
40ms Document
text/html 65.9.66.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-18.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 37310
content-length: 116
content-type: text/html
date: Tue, 05 Jul 2022 01:40:02 GMT
etag: "517f2062d883c0ee35479a2da0c50b8c"
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: AmazonS3
via: 1.1 4f114016fe4d6c05531b0486ec2868be.cloudfront.net (CloudFront)
x-amz-cf-id: o0mRnl1Ip9IJ5t5Ae0IPe-scs-rIcWBHf6EvkNa-9P3IcKnfyoM2gw==
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront

GET
H2 200 / Show response
csync.smilewanted.com/ Frame 5F31 6 KB
2 KB 82ms
73ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82009546877bd0e33897de19d48b10a89c32182f68eeaecd8461d0e94dc80873

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 725ff2c6bffa88aa-LHR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 12:01:51 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

beacon Show response
ap.lijit.com/ Frame FC38
Redirect Chain

https://ap.lijit.com/beacon?informer=13396601
https://ap.lijit.com/beacon?informer=13396601&dnr=1

5 KB
6 KB

44ms
43ms

Document
text/html

72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: efc21435e7495943a604c834a2c556caaa8b8d92c2a1d7de4169434bbe23194f

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 5426
Content-Type: text/html
Date: Tue, 05 Jul 2022 12:01:51 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ams1

Redirect headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 0
Date: Tue, 05 Jul 2022 12:01:51 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Location: https://ap.lijit.com/beacon?informer=13396601&dnr=1
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ams1

GET
H/1.1 200
OK check.html Show response
biddr.brealtime.com/ Frame 4CD7 926 B
1 KB 101ms
30ms Document
text/html 104.17.120.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://biddr.brealtime.com/check.html
Requested by: Host: adxbid.info
URL: https://adxbid.info/nasloviDesktopHomepage.js?x=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.17.120.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Referer: https://naslovi.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Age: 5384
CF-Cache-Status: HIT
CF-RAY: 725ff2c72e473601-MAN
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 05 Jul 2022 12:01:51 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expires: Tue, 05 Jul 2022 13:01:51 GMT
Last-Modified: Tue, 08 Sep 2020 13:51:51 GMT
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
x-amz-id-2: TEaHLRBIbHjYMOFhGTzvIZy2PzjlbwQZ4Pmn1wJ4NZ6PfdodaogyuLrUihoJ51VqKHgPwjvkpDU=
x-amz-request-id: FKK67Q5YQT5Q7AX7

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 718D 7 KB
3 KB 164ms
41ms Script
text/javascript 99.86.4.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=300&h=250&c=digitas01cont2&js=pmw1&base=te-clr1-3d4a6da8-46a9-49cd-bf4c-e5c844894fe0

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont2&w=300&h=250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.4.38 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6c6e47a585e3e2c736d322e40212b77d2fc34a05249b46017a5e35826da69ebe

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' ; prefetch-src 'self' ;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:27:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5682
cross-origin-embedder-policy: unsafe-none
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding, Origin
content-length: 2464
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
x-frame-options: SAMEORIGIN
expect-ct: max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript;charset=UTF-8
via: 1.1 a350f357b825293e306b1b0a2cb490c0.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: SnAR277F63PxHnbhydS4vnQeOW_Ijr9AsomdMRYnCiA7DdQMrgotzA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 718D 38 KB
12 KB 167ms
45ms Script
text/javascript 99.86.4.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=300&h=250&c=digitas01cont2&js=pmw2

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont2&w=300&h=250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.4.38 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-4-38.fra6.r.cloudfront.net

Software

nginx /

Resource Hash

e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' ; prefetch-src 'self' ;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 10:49:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4353
cross-origin-embedder-policy: unsafe-none
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding, Origin
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
x-frame-options: SAMEORIGIN
expect-ct: max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript;charset=UTF-8
via: 1.1 a350f357b825293e306b1b0a2cb490c0.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: -OigX1ES9AwegfHAl5ZRIZW0JXF2SqsxTsqjx6gMSFgiwrW5f2u8IQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 718D 43 B
1 KB 258ms
136ms Image
image/gif 99.86.4.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.trustarc.com/cap?aid=hpeus01&pid=digitas01&cid=1&w=300&h=250&c=6265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.4.38 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-4-38.fra6.r.cloudfront.net

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' ; prefetch-src 'self' ;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://9979bc8f34406befdbd05c2225c2ec8b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:51 GMT
via: 1.1 a350f357b825293e306b1b0a2cb490c0.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA6-C1
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
vary: Origin
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
x-frame-options: SAMEORIGIN
expect-ct: max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-id: 0GWFMnNgq55sP4CHowZ4fDP0yrLhi3Eos02UVb-KVsMsb0gApaiaLw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=22144e6d-bb28-4bf0-912b-33c1b2b0cc6e

0
932 B

53ms
53ms

Image
text/plain

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=22144e6d-bb28-4bf0-912b-33c1b2b0cc6e
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
X-MERGE: GDPR Optout true
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: //ce.lijit.com/merge?pid=87&3pid=22144e6d-bb28-4bf0-912b-33c1b2b0cc6e
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1 204
No Content sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame FC38 0
239 B 504ms
108ms Image
image/gif 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Content-Type: image/gif

GET
H2 200 cksync.php
contextual.media.net/ Frame FC38 44 B
291 B 190ms
75ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=sov&ovsid=E7LRqNZHG0Seizx-SWOZ_Uls&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1023%263pid%3D%24%7BUSER%7D&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

1681cb2b2db935f48c843351945df3f3f77f79c1c8de28c4fa88d8b655c25ae2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
server: Apache
date: Tue, 05 Jul 2022 12:01:51 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 44
x-mnet-hl2: E
expires: Tue, 05 Jul 2022 12:01:51 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=17&mt_exuid=E7LRqNZHG0Seizx-SWOZ_Uls&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D3%263pid%3D%5BUUID%5D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=3&3pid=4ea962c4-282e-4700-9c1b-f8e5b57e4fcb&gdpr=0&gdpr_consent=

43 B
974 B

135ms
41ms

Image
image/gif

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=3&3pid=4ea962c4-282e-4700-9c1b-f8e5b57e4fcb&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Tue, 05 Jul 2022 12:01:51 GMT
Server: MT3 4475 c1dc35a master zrh-pixel-x25 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ce.lijit.com/merge?pid=3&3pid=4ea962c4-282e-4700-9c1b-f8e5b57e4fcb&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 05 Jul 2022 12:01:50 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame FC38 0
239 B 211ms
51ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Content-Type: image/gif

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://ce.lijit.com/merge?pid=85&3pid=AAFUYE7FiFAAABEJr-Sm6A&gdpr=0

43 B
1 KB

62ms
49ms

Image
image/gif

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=85&3pid=AAFUYE7FiFAAABEJr-Sm6A&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=85&3pid=AAFUYE7FiFAAABEJr-Sm6A&gdpr=0
Date: Tue, 05 Jul 2022 12:01:51 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=12&3pid=6413238230184238334&gdpr=0&gdpr_consent=

43 B
958 B

135ms
37ms

Image
image/gif

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=12&3pid=6413238230184238334&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7b4cabe3-b051-4ce5-a08d-ae95b2cf91fe
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ce.lijit.com/merge?pid=12&3pid=6413238230184238334&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
https://ce.lijit.com/merge?pid=86&3pid=gy8QFGZTmi5fqr4gILhW&pi=sovrn&gdpr=0&gdpr_consent=&tc=1

43 B
959 B

153ms
52ms

Image
image/gif

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=86&3pid=gy8QFGZTmi5fqr4gILhW&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=86&3pid=gy8QFGZTmi5fqr4gILhW&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT, Tue, 05 Jul 2022 12:01:51 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=E7LRqNZHG0Seizx-SWOZ_Uls&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:15f091242cc49191921d4b7c20435fad

0
932 B

45ms
43ms

Image
text/plain

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:15f091242cc49191921d4b7c20435fad
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
X-MERGE: GDPR Optout true
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

date: Tue, 05 Jul 2022 12:01:51 GMT
server: Aorta/20220620.4208e54c
location: https://ce.lijit.com/merge?pid=84&3pid=c:15f091242cc49191921d4b7c20435fad
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
access-control-allow-origin
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 3649e23228bc
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=1827&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=10&3pid=5123196422577058593

0
756 B

111ms
37ms

Image
text/plain

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=10&3pid=5123196422577058593
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
X-MERGE: GDPR Optout true
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: https://ce.lijit.com/merge?pid=10&3pid=5123196422577058593
Date: Tue, 05 Jul 2022 12:01:51 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

reporting
ap.lijit.com/dsp/google/ Frame FC38
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=RTdMUnFOWkhHMFNlaXp4LVNXT1pfVWxz&gdpr=0
https://ap.lijit.com/dsp/google/reporting?gdpr=0

43 B
552 B

105ms
35ms

Image
image/gif

72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/dsp/google/reporting?gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: *
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Content-Type: image/gif
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ap.lijit.com/dsp/google/reporting?gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 245
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame FC38 0
191 B 120ms
34ms Image
text/plain 66.155.71.150
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=${gdpr}&gdpr_consent=${gdpr_consent}&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.150 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:50 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://bcp.crwdcntrl.net/5/c=5436/tp=SVRN/tpid=E7LRqNZHG0Seizx-SWOZ_Uls/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=E7LRqNZHG0Seizx-SWOZ_Uls/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=5001&3pid=&gdpr=0&gdpr_consent=

43 B
2 KB

45ms
45ms

Image
image/gif

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=5001&3pid=&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ce.lijit.com/merge?pid=5001&3pid=&gdpr=0&gdpr_consent=
expires: 0
cache-control: no-cache
x-server: 10.45.11.175
content-length: 0
x-consent: absent

GET
H/1.1

200
OK

noop
px.owneriq.net/ Frame FC38
Redirect Chain

https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent=
https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q7103089111581480238&ref=%2Feucm%2Fp%2Fsv
https://px.owneriq.net/noop?ct=image%2Fgif

0
287 B

41ms
41ms

Image
image/gif

23.75.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/noop?ct=image%2Fgif
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 23.75.246.168 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-246-168.deploy.static.akamaitechnologies.com
Software: Apache/2.4.6 (CentOS) / PHP/7.3.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 05 Jul 2022 12:01:51 GMT
Server: Apache/2.4.6 (CentOS)
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
X-Powered-By: PHP/7.3.33
Content-Length: 0
Content-Type: image/gif

Redirect headers

Location: https://px.owneriq.net/noop?ct=image%2Fgif
Date: Tue, 05 Jul 2022 12:01:51 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://um.simpli.fi/lj_match?r=1657022511190&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=9893856151B144B49E88E366140B4066

0
932 B

51ms
51ms

Image
text/plain

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=9893856151B144B49E88E366140B4066
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
X-MERGE: GDPR Optout true
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

date: Tue, 05 Jul 2022 12:01:51 GMT
x-content-type-options: nosniff
server: nginx
location: https://ce.lijit.com/merge?pid=2&3pid=9893856151B144B49E88E366140B4066
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Mon, 04 Jul 2022 12:01:51 GMT

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://p.rfihub.com/cm?in=1&pub=20513&ssp=fmx
https://x.bidswitch.net/sync?dsp_id=119&user_id=5123196422577058593&expires=30&ssp=fmx
https://ce.lijit.com/merge?pid=26&3pid=423a38db-bfe9-4826-9c7e-711a58e66144&gdpr=&gdpr_consent=

0
1 KB

47ms
46ms

Image
text/plain

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=423a38db-bfe9-4826-9c7e-711a58e66144&gdpr=&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
X-MERGE: GDPR Optout true
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: //ce.lijit.com/merge?pid=26&3pid=423a38db-bfe9-4826-9c7e-711a58e66144&gdpr=&gdpr_consent=
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

iu3
aax-eu.amazon-adsystem.com/s/ Frame FC38
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t

0
0

203ms
203ms

Image
text/html

52.94.220.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 52.94.220.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: ZKNYVPTMGYJASM5EERGA
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=&gdpr_consent=&us_privacy=&3pid=5C9-meAlL8v_JCiZtCowzrB_JJ__L3vO4Xy9smAw

0
932 B

46ms
44ms

Image
text/plain

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=&gdpr_consent=&us_privacy=&3pid=5C9-meAlL8v_JCiZtCowzrB_JJ__L3vO4Xy9smAw
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
X-MERGE: GDPR Optout true
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=&gdpr_consent=&us_privacy=&3pid=5C9-meAlL8v_JCiZtCowzrB_JJ__L3vO4Xy9smAw
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 generic
data.adsrvr.org/track/cmf/ Frame FC38 70 B
264 B 47ms
39ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame FC38
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=49&3pid=BKF3gGV32j4q&ev=1&pid=558511&gdpr_consent=&gdpr=0

43 B
2 KB

52ms
51ms

Image
image/gif

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=49&3pid=BKF3gGV32j4q&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:52 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-GB
location: https://ce.lijit.com/merge?pid=49&3pid=BKF3gGV32j4q&ev=1&pid=558511&gdpr_consent=&gdpr=0
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5fbd64586c-mt8jd
expires: -1

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame FC38
Redirect Chain

https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/sovrn?zcc=1&cb=1657022511757
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6697110140

70 B
264 B

40ms
39ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6697110140
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: H2
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: Tengine
etag: RX845e90f36aa9422586cdea80316b8ccc003
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6697110140
cache-control: no-store, no-cache, must-revalidate
content-type: text/html
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FC38
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RTdMUnFOWkhHMFNlaXp4LVNXT1pfVWxz&gdpr=0

170 B
188 B

52ms
51ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RTdMUnFOWkhHMFNlaXp4LVNXT1pfVWxz&gdpr=0

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 05 Jul 2022 12:01:51 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RTdMUnFOWkhHMFNlaXp4LVNXT1pfVWxz&gdpr=0
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2 200 decode_consent.js Show response
static.smilewanted.com/js/decode_consent/ Frame 5F31 48 KB
12 KB 57ms
47ms Script
application/javascript 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.smilewanted.com/js/decode_consent/decode_consent.js

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://csync.smilewanted.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 431652
vary: Accept-Encoding
x-xss-protection: 1; mode=block
referrer-policy: strict-origin
last-modified: Thu, 15 Apr 2021 17:11:55 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"607873db-c1ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 725ff2c7793388aa-LHR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E07A 15 KB
6 KB 151ms
41ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=21948
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 12:01:51 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 05 Jul 2022 18:07:39 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4A7E 15 KB
6 KB 152ms
43ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=21948
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 12:01:51 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 05 Jul 2022 18:07:39 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H3

200

cm Show response
us-u.openx.net/w/1.0/ Frame 6584
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_c...
https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&g...

755 B
485 B

74ms
38ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 5ba610c63bf9011fdaa290e92b69b268c352d88310ac20f083c8114d6fd7e653

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 466
content-type: text/html
date: Tue, 05 Jul 2022 12:01:51 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Tue, 05 Jul 2022 12:01:51 GMT
location: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/7f1e280
via: 1.1 google

GET
H/1.1

200
OK

merge Show response
ce.lijit.com/ Frame A918
Redirect Chain

https://d.turn.com/r/dd/id/L21rdC8xMjcvY2lkLzI4NTUyOTczL3QvMg/url/https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1%263pid%3D%24!%7BTURN_UUID%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=1&3pid=7017125634408710706&gdpr=0&gdpr_consent=

43 B
957 B

79ms
39ms

Document
image/gif

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=1&3pid=7017125634408710706&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13396601&dnr=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 43
Content-Type: image/gif
Date: Tue, 05 Jul 2022 12:01:51 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap1ams1

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
date: Tue, 05 Jul 2022 12:01:51 GMT
location: https://ce.lijit.com/merge?pid=1&3pid=7017125634408710706&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
pragma: no-cache

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame FDBA 3 KB
4 KB 41ms
40ms Script
application/javascript 65.9.66.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-18.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 196b425485c119046eada45bc1a473e6c35f7f8c5a94824873535de823af517f

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 08:51:02 GMT
via: 1.1 4f114016fe4d6c05531b0486ec2868be.cloudfront.net (CloudFront)
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: AmazonS3
age: 11450
etag: "74ede07ef946dc2316f86b2661cf2dd3"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 3302
x-amz-cf-id: cSrwhr5rkEzOlySIuIfwF25JD7fJBwzofy32klrkYiC0RzhrLrY2jg==

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 811E 31 KB
10 KB 55ms
54ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: f8cd96fe86c32769f5f9f5d72b5a5d7bc20623fc09c460122e1ffbc8cac5a59b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 05 Jul 2022 12:01:51 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=59409
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9455
Expires: Wed, 06 Jul 2022 04:32:00 GMT

GET
H2 200 drop_cookie_sw.php Show response
csync.smilewanted.com/ Frame 0266 0
321 B 76ms
76ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/drop_cookie_sw.php
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 725ff2c7d9f088aa-LHR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 12:01:51 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

setuid Show response
ib.adnxs.com/prebid/ Frame 71E8
Redirect Chain

https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%...
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=68791a8c972790cc074d6e0ec2e51e25

43 B
1 KB

60ms
58ms

Document
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=68791a8c972790cc074d6e0ec2e51e25

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

AN-X-Request-Uuid: acfb50ab-7fbe-4a5c-93c0-f24b0ff6ae32
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 05 Jul 2022 12:01:51 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 725ff2c7e9fc88aa-LHR
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 12:01:51 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=68791a8c972790cc074d6e0ec2e51e25
server: cloudflare

GET buyers
dmx.districtm.io/s/v1/ Frame FDBA 0
0

GET
H2 200 connectmyusers.php Show response
cdn.connectad.io/ Frame EE64 1 KB
910 B 201ms
90ms Document
text/html 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 725ff2c8eac923df-ZRH
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 05 Jul 2022 12:01:51 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

getuid Show response
sync.smartadserver.com/ Frame EB2E
Redirect Chain

https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]
https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]&cklb=1

0
75 B

39ms
36ms

Document
text/plain

185.86.137.133
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]&cklb=1
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.133 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

content-length: 0
date: Tue, 05 Jul 2022 12:01:51 GMT

Redirect headers

cache-control: no-cache,no-store
content-length: 0
date: Tue, 05 Jul 2022 12:01:50 GMT
location: https://sync.smartadserver.com:443/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]&cklb=1
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma: no-cache

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame E07A 0
42 B 506ms
165ms Script
text/plain 192.82.242.209
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=16501513&p=137711&s=137812&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.82.242.209 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:50 GMT
content-length: 0

GET
H/1.1 204
No Content merge
ce.lijit.com/ Frame 6584 0
756 B 115ms
48ms Image
text/plain 72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=76&3pid=11c173b8-f20a-0cf0-2b38-c0518f00567e
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:51 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
X-MERGE: GDPR Optout true
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 6584
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=4ea962c4-282e-4700-9c1b-f8e5b57e4fcb

43 B
180 B

54ms
46ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=4ea962c4-282e-4700-9c1b-f8e5b57e4fcb
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 05 Jul 2022 12:01:51 GMT
Server: MT3 4475 c1dc35a master zrh-pixel-x9 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=4ea962c4-282e-4700-9c1b-f8e5b57e4fcb
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 05 Jul 2022 12:01:50 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 6584
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=ClYx7w5cYL0RXDS9Wld_4l9XZL8RU2TuWgKXKU5u

43 B
61 B

36ms
35ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&&val=ClYx7w5cYL0RXDS9Wld_4l9XZL8RU2TuWgKXKU5u
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&&val=ClYx7w5cYL0RXDS9Wld_4l9XZL8RU2TuWgKXKU5u
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

sd
eu-u.openx.net/w/1.0/ Frame 6584
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://c1.adform.net/serving/cookie/match?CC=1&party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4670888357724265477

43 B
61 B

34ms
33ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4670888357724265477
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4670888357724265477
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 6584 70 B
265 B 135ms
39ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=7d2fad78-18be-36fd-6c84-76f7f7b1692c&gdpr=0
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 6584 170 B
188 B 63ms
50ms Image
image/png 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTE0MDdlYjItZDFjOS02ODU5LTc5NjQtMmM0ZTNkNTNhNzRj

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 6584
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENCkX6HzNNYGaW6N5AYW9aw&google_cver=1

43 B
61 B

32ms
31ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENCkX6HzNNYGaW6N5AYW9aw&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENCkX6HzNNYGaW6N5AYW9aw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 709414.gif
id.rlcdn.com/ Frame 811E 0
0 110ms
38ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 811E 70 B
264 B 123ms
40ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 811E
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=EtK_maW7SUqkYrOS7w-u7w&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=EtK_maW7SUqkYrOS7w-u7w

43 B
797 B

120ms
119ms

Image
image/gif

52.94.220.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=EtK_maW7SUqkYrOS7w-u7w

Protocol

HTTP/1.1

Server

52.94.220.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:52 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: HBTX6YXMR4JDTDN0DXXX
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=EtK_maW7SUqkYrOS7w-u7w
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 811E
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L584F1QH-1W-L8P6&sigv=1&esig=2~8e8e18852569f1b38084f24d4a9c194e4731733c

0
194 B

149ms
47ms

Image
text/plain

2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L584F1QH-1W-L8P6&sigv=1&esig=2~8e8e18852569f1b38084f24d4a9c194e4731733c

Protocol

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:51 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L584F1QH-1W-L8P6&sigv=1&esig=2~8e8e18852569f1b38084f24d4a9c194e4731733c
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 811E
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L584F1QH-1W-L8P6

0
708 B

238ms
172ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L584F1QH-1W-L8P6
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 12:01:51 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 63862021CD764A23B19B30444CB6DFB3 Ref B: LON21EDGE0809 Ref C: 2022-07-05T12:01:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXjDZ4z8Vl67zgOpLCBPA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L584F1QH-1W-L8P6
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 811E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJVt-Zak00jMxfDBC9SO0w4&google_cver=1

0
239 B

82ms
44ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJVt-Zak00jMxfDBC9SO0w4&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 05 Jul 2022 12:01:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJVt-Zak00jMxfDBC9SO0w4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 811E
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=EQDTETW5T8mqISu1CcpwtA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=EQDTETW5T8mqISu1CcpwtA

43 B
556 B

123ms
122ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=EQDTETW5T8mqISu1CcpwtA

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jul 2022 12:01:52 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: DM5K46ZGEP4N7KGRMZKA
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=EQDTETW5T8mqISu1CcpwtA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 811E
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDU4NEYxUUgtMVctTDhQNg==

170 B
188 B

59ms
57ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDU4NEYxUUgtMVctTDhQNg==

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS