urlscan.io logo urlscan.io
SecurityTrails logo

www.sawfirst.com Open in urlscan Pro
66.206.12.119  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.sawfirst.com/
Effective URL: https://www.sawfirst.com/
Submission: On May 17 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 30 IPs in 6 countries across 37 domains to perform 113 HTTP transactions. The main IP is 66.206.12.119, located in United States and belongs to HVC-AS, US. The main domain is www.sawfirst.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 3rd 2021. Valid for: 3 months.
This is the only time www.sawfirst.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 13 66.206.12.119 29802 (HVC-AS)
1 2a00:1450:400... 15169 (GOOGLE)
6 35.190.55.95 15169 (GOOGLE)
16 104.22.3.144 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 93.93.51.191 34655 (DOCLER-AS)
1 208.100.17.183 32748 (STEADFAST)
2 7 2.18.234.21 16625 (AKAMAI-AS)
1 51.89.9.252 16276 (OVH)
5 5 185.64.190.79 62713 (AS-PUBMATIC)
8 8 142.250.74.194 15169 (GOOGLE)
2 2 185.64.190.80 62713 (AS-PUBMATIC)
2 2 185.64.190.81 62713 (AS-PUBMATIC)
4 4 37.252.173.38 29990 (ASN-APPNEX)
3 3 3.126.56.137 16509 (AMAZON-02)
1 1 213.19.147.44 3356 (LEVEL3)
1 1 70.42.32.95 13789 (INTERNAP-...)
1 178.162.133.149 60781 (LEASEWEB-...)
1 34.251.124.7 16509 (AMAZON-02)
1 174.137.133.49 27257 (WEBAIR-IN...)
2 2 52.28.254.214 16509 (AMAZON-02)
1 38.27.122.126 174 (COGENT-174)
2 2 216.52.2.30 30282 (AS-INAPCD...)
1 1 193.0.160.128 54312 (ROCKETFUEL)
1 67.202.110.23 32748 (STEADFAST)
5 93.93.51.200 34655 (DOCLER-AS)
1 2a00:1450:400... 15169 (GOOGLE)
8 130.211.31.231 15169 (GOOGLE)
1 93.93.51.190 34655 (DOCLER-AS)
1 2 72.21.206.140 16509 (AMAZON-02)
1 76.223.111.131 16509 (AMAZON-02)
1 1 66.155.71.25 13768 (COGECO-PEER1)
1 52.202.1.196 14618 (AMAZON-AES)
1 35.241.40.233 15169 (GOOGLE)
2 2 3.125.99.7 16509 (AMAZON-02)
35 2606:4700:303... 13335 (CLOUDFLAR...)
113 30
13    66.206.12.119 (United States)

ASN29802 (HVC-AS, US)
PTR: 66-206-12-119.static.hvvc.us
www.sawfirst.com
1    2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
6    35.190.55.95 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 95.55.190.35.bc.googleusercontent.com
www.onclickperformance.com
16    104.22.3.144 (United States)

ASN13335 (CLOUDFLARENET, US)
resources.infolinks.com
router.infolinks.com
1    2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
3    2606:4700:3037::6815:293c (United States)

ASN13335 (CLOUDFLARENET, US)
superonclick.com
1    2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2606:4700:3037::ac43:8e31 (United States)

ASN13335 (CLOUDFLARENET, US)
ufpcdn.com
1    2606:4700:3038::6815:eb72 (United States)

ASN13335 (CLOUDFLARENET, US)
crrepo.com
2    93.93.51.191 (Luxembourg)

ASN34655 (DOCLER-AS, LU)
pt.potawe.com
1    208.100.17.183 (United States)

ASN32748 (STEADFAST, US)
PTR: ip183.208-100-17.static.steadfastdns.net
de.tynt.com
7    2.18.234.21 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
1    51.89.9.252 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip252.ip-51-89-9.eu
onetag-sys.com
5    185.64.190.79 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
8    142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net
cm.g.doubleclick.net
2    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
2    185.64.190.81 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
4    37.252.173.38 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
3    3.126.56.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
1    213.19.147.44 (United Kingdom)

ASN3356 (LEVEL3, US)
sync.1rx.io
1    70.42.32.95 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
1    178.162.133.149 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
1    34.251.124.7 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-124-7.eu-west-1.compute.amazonaws.com
s.cpx.to
1    174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)
dsp.adkernel.com
2    52.28.254.214 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-254-214.eu-central-1.compute.amazonaws.com
pixel.advertising.com
1    38.27.122.126 (United States)

ASN174 (COGENT-174, US)
match.bnmla.com
2    216.52.2.30 (United States)

ASN30282 (AS-INAPCDN-OCY, US)
ap.lijit.com
1    193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
1    67.202.110.23 (United States)

ASN32748 (STEADFAST, US)
PTR: ip23.67-202-110.static.steadfastdns.net
ssc-cms.33across.com
5    93.93.51.200 (Luxembourg)

ASN34655 (DOCLER-AS, LU)
pt-static4.ptwmstc.com
pt-static5.ptwmstc.com
pt-static3.ptwmstc.com
1    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
8    130.211.31.231 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 231.31.211.130.bc.googleusercontent.com
discovernative.com
1    93.93.51.190 (Luxembourg)

ASN34655 (DOCLER-AS, LU)
galleryn2.awemdia.com
2    72.21.206.140 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: 206-140.amazon.com
s.amazon-adsystem.com
1    76.223.111.131 (United States)

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com
match.adsrvr.org
1    66.155.71.25 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
1    52.202.1.196 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-1-196.compute-1.amazonaws.com
rtb.adentifi.com
1    35.241.40.233 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 233.40.241.35.bc.googleusercontent.com
dmp.brand-display.com
2    3.125.99.7 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
pm.w55c.net
35    2606:4700:3034::ac43:81e7 (United States)

ASN13335 (CLOUDFLARENET, US)
cdnativ.com
Apex Domain
Subdomains		 Transfer
35 cdnativ.com
cdnativ.com
2 MB
16 infolinks.com
resources.infolinks.com
router.infolinks.com
274 KB
13 sawfirst.com
www.sawfirst.com
577 KB
9 pubmatic.com
image8.pubmatic.com
image2.pubmatic.com
image4.pubmatic.com
3 KB
9 doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
6 KB
8 discovernative.com
discovernative.com
15 KB
7 casalemedia.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
8 KB
6 onclickperformance.com
www.onclickperformance.com
9 KB
5 ptwmstc.com
pt-static4.ptwmstc.com
pt-static5.ptwmstc.com
pt-static3.ptwmstc.com
43 KB
4 adnxs.com
ib.adnxs.com
4 KB
3 yahoo.com
ups.analytics.yahoo.com
3 KB
3 google-analytics.com
www.google-analytics.com
38 KB
3 superonclick.com
superonclick.com
18 KB
2 w55c.net
pm.w55c.net
1 KB
2 amazon-adsystem.com
s.amazon-adsystem.com
961 B
2 lijit.com
ap.lijit.com
1 KB
2 advertising.com
pixel.advertising.com
676 B
2 potawe.com
pt.potawe.com
3 KB
2 googletagmanager.com
www.googletagmanager.com
70 KB
1 brand-display.com
dmp.brand-display.com
253 B
1 adentifi.com
rtb.adentifi.com
88 B
1 sitescout.com
pixel-sync.sitescout.com
299 B
1 adsrvr.org
match.adsrvr.org
265 B
1 awemdia.com
galleryn2.awemdia.com
3 MB
1 33across.com
ssc-cms.33across.com
89 B
1 rfihub.com
p.rfihub.com
759 B
1 bnmla.com
match.bnmla.com
114 B
1 adkernel.com
dsp.adkernel.com
233 B
1 cpx.to
s.cpx.to
945 B
1 sonobi.com
sync.go.sonobi.com
474 B
1 zemanta.com
b1sync.zemanta.com
288 B
1 1rx.io
sync.1rx.io
184 B
1 onetag-sys.com
onetag-sys.com
818 B
1 tynt.com
de.tynt.com
289 B
1 crrepo.com
crrepo.com
53 KB
1 ufpcdn.com
ufpcdn.com
2 KB
1 googlesyndication.com
pagead2.googlesyndication.com
49 KB
113 37
Domain Requested by
35 cdnativ.com www.sawfirst.com
superonclick.com
13 router.infolinks.com resources.infolinks.com
router.infolinks.com
ssum-sec.casalemedia.com
13 www.sawfirst.com 1 redirects www.sawfirst.com
8 discovernative.com www.sawfirst.com
superonclick.com
8 cm.g.doubleclick.net 8 redirects
6 www.onclickperformance.com www.sawfirst.com
www.onclickperformance.com
5 image8.pubmatic.com 5 redirects
4 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
4 ib.adnxs.com 4 redirects
3 ups.analytics.yahoo.com 3 redirects
3 ssum-sec.casalemedia.com 1 redirects router.infolinks.com
ssum-sec.casalemedia.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 superonclick.com www.sawfirst.com
superonclick.com
3 resources.infolinks.com www.sawfirst.com
resources.infolinks.com
2 pm.w55c.net 2 redirects
2 s.amazon-adsystem.com 1 redirects ssum-sec.casalemedia.com
2 pt-static5.ptwmstc.com pt.potawe.com
pt-static5.ptwmstc.com
2 pt-static4.ptwmstc.com pt.potawe.com
2 ap.lijit.com 2 redirects
2 pixel.advertising.com 2 redirects
2 image4.pubmatic.com 2 redirects
2 image2.pubmatic.com 2 redirects
2 pt.potawe.com www.onclickperformance.com
pt.potawe.com
2 www.googletagmanager.com www.sawfirst.com
pt.potawe.com
1 dmp.brand-display.com ssum-sec.casalemedia.com
1 rtb.adentifi.com ssum-sec.casalemedia.com
1 pixel-sync.sitescout.com 1 redirects
1 match.adsrvr.org ssum-sec.casalemedia.com
1 galleryn2.awemdia.com pt.potawe.com
1 pt-static3.ptwmstc.com pt.potawe.com
1 ssc-cms.33across.com router.infolinks.com
1 p.rfihub.com 1 redirects
1 match.bnmla.com router.infolinks.com
1 dsp.adkernel.com router.infolinks.com
1 s.cpx.to router.infolinks.com
1 sync.go.sonobi.com router.infolinks.com
1 b1sync.zemanta.com 1 redirects
1 sync.1rx.io 1 redirects
1 onetag-sys.com router.infolinks.com
1 de.tynt.com router.infolinks.com
1 crrepo.com www.onclickperformance.com
1 ufpcdn.com superonclick.com
1 googleads.g.doubleclick.net pagead2.googlesyndication.com
1 pagead2.googlesyndication.com www.sawfirst.com
113 44

This site contains links to these domains. Also see Links.

Domain
discovernative.com
www.facebook.com
twitter.com
feeds.feedburner.com
pinterest.com
Subject Issuer Validity Valid
sawfirst.com
cPanel, Inc. Certification Authority		 2021-03-03 -
2021-06-01		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-04-13 -
2021-07-06		 3 months crt.sh
onclickperformance.com
Sectigo RSA Domain Validation Secure Server CA		 2021-01-22 -
2022-01-22		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-15 -
2021-08-15		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-04-13 -
2021-07-06		 3 months crt.sh
*.google.com
GTS CA 1O1		 2021-04-13 -
2021-07-06		 3 months crt.sh
awecre.com
R3		 2021-04-16 -
2021-07-15		 3 months crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA		 2020-06-01 -
2021-09-30		 a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
onetag-sys.com
R3		 2021-05-02 -
2021-07-31		 3 months crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2020-12-06 -
2022-01-07		 a year crt.sh
s.cpx.to
Sectigo RSA Domain Validation Secure Server CA		 2021-02-03 -
2022-02-09		 a year crt.sh
*.adkernel.com
Sectigo RSA Domain Validation Secure Server CA		 2020-12-22 -
2022-01-05		 a year crt.sh
*.bnmla.com
Go Daddy Secure Certificate Authority - G2		 2021-01-06 -
2022-02-07		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2020-06-01 -
2021-09-30		 a year crt.sh
ccs.bimbim.com
R3		 2021-05-10 -
2021-08-08		 3 months crt.sh
discovernative.com
Sectigo RSA Domain Validation Secure Server CA		 2021-03-04 -
2022-03-04		 a year crt.sh
*.awemdia.com
Sectigo RSA Domain Validation Secure Server CA		 2021-04-21 -
2022-05-12		 a year crt.sh
s.amazon-adsystem.com
Amazon		 2020-08-28 -
2021-08-20		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
adentifi.com
Amazon		 2020-10-02 -
2021-11-02		 a year crt.sh
*.brand-display.com
GeoTrust RSA CA 2018		 2020-06-24 -
2022-06-24		 2 years crt.sh

This page contains 14 frames:

Primary Page: https://www.sawfirst.com/
Frame ID: 1924029E7D9B1B4CD7CBDA6F45F531DA
Requests: 41 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210511/r20190131/zrt_lookup.html
Frame ID: 1EF0812F9D05A62882AA8E08746383FE
Requests: 1 HTTP requests in this frame

Frame: https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2C8NiajY2JqB1dAN0dEdHP3xP.518%2CZMkKdRAQlkuDbgTABrav5A2p3doafuCDkjslrbo6QE-1x0i8I78m7lFPF8YQuUfeUt5_5ShnXnMtIAAHKDC7RnUBnmcimBPhm9YazYF4dDA%2C&cbrandom=0.7350881215455829&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
Frame ID: 8DC5CD5C24F93363AD2F626D8EAD8045
Requests: 3 HTTP requests in this frame

Frame: https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2CgtjO-YiIqB1dAN0dEdHP3xP.cea%2CZMkKdRAQlkuDbgTABrav5O7Q77TZamOMI-XCDUXdq4ae8JFo5gQ3FJJhSQqsgGgArZrep_ioVelvL4_p7DaOhnhMnlgLDR1XT6LV7auXo5E%2C&cbrandom=0.2765018932972929&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
Frame ID: 1D0BA5389FCB7564C1D406E74D7AD02E
Requests: 2 HTTP requests in this frame

Frame: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Frame ID: A15768191630EA7A1C696E69423E6F31
Requests: 16 HTTP requests in this frame

Frame: https://ufpcdn.com/script/identify.html?frmt=0
Frame ID: 677D284665A95FE88A085EDB38D49CAD
Requests: 1 HTTP requests in this frame

Frame: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Frame ID: 096C27661385F1DC60E4633470196597
Requests: 10 HTTP requests in this frame

Frame: https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
Frame ID: F4B51DA1FEA227FB7DCB0D1C3B4E892C
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Frame ID: 73C13B507814330AE5C024C801988AC9
Requests: 10 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Frame ID: D9EC53DC919F6E84EEB08F4187B3FC1A
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 21AC3FA3924D10E943012832F68EA6FB
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: 1510E81FEE55EE379D7FCCD59B1A3299
Requests: 10 HTTP requests in this frame

Frame: data://truncated
Frame ID: 3259F68C631A78994EE9E8CE7EF30F1D
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: 66B6C0E326E5EAFB38DECF652A3808EC
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.sawfirst.com/ HTTP 301
    https://www.sawfirst.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i
Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

113
Requests

100 %
HTTPS

24 %
IPv6

37
Domains

44
Subdomains

30
IPs

6
Countries

5664 kB
Transfer

6762 kB
Size

23
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.sawfirst.com/ HTTP 301
    https://www.sawfirst.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31
  • https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Request Chain 33
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Qzk3MzBBMTctQkI3Ri00QjE2LTkwNzktQkNDQ0YwQTRENEY5&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Qzk3MzBBMTctQkI3Ri00QjE2LTkwNzktQkNDQ0YwQTRENEY5&gdpr=0&gdpr_consent=&google_tc= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DC9730A17-BB7F-4B16-9079-BCCCF0A4D4F9 HTTP 302
  • https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
Request Chain 34
  • https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID HTTP 302
  • https://router.infolinks.com/dyn/apn-usync?user_id=5680856009878954723
Request Chain 35
  • https://ups.analytics.yahoo.com/ups/58422/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58422/occ?verify=true HTTP 302
  • https://router.infolinks.com/dyn/VR-usync?uid=y-MPoWERdE2uErF0CYrntgErahaFQvLpA6ebR0Mb4-~A
Request Chain 36
  • https://sync.1rx.io/usersync2/infolinks HTTP 302
  • https://router.infolinks.com/dyn/r1-usync?uid=OPTOUT
Request Chain 37
  • https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__ HTTP 302
  • https://router.infolinks.com/dyn/zmn-usync?uid=
Request Chain 39
  • https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fwww.sawfirst.com%252F&pid=12306&adnxs_uid=$UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttps%25253A%25252F%25252Fwww.sawfirst.com%25252F%26pid%3D12306%26adnxs_uid%3D%24UID HTTP 302
  • https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.sawfirst.com%2F&pid=12306&adnxs_uid=5680856009878954723
Request Chain 41
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPee9d88d1-b745-11eb-a180-0221adc671b4 HTTP 302
  • https://router.infolinks.com/dyn/outh-usync?uid=y-YE6TRwRE2uEp281Js4SUP8LT8G3SxkqO~A~UPee9d88d1-b745-11eb-a180-0221adc671b4
Request Chain 43
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true HTTP 307
  • https://router.infolinks.com/dyn/sovrn-usync?uid=aaff1fbdd30bcda3cd76a78f
Request Chain 44
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fusersync%253Fpmuservalue%253D%2523PMUID HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUNERDRERUYtQTE5MC00MTA1LTk4RDItQzM5RURCOTVCNjFE&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUNERDRERUYtQTE5MC00MTA1LTk4RDItQzM5RURCOTVCNjFE&gdpr=0&gdpr_consent=&google_tc= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DC9730A17-BB7F-4B16-9079-BCCCF0A4D4F9 HTTP 302
  • https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
Request Chain 46
  • https://p.rfihub.com/cm?pub=43153&in=1 HTTP 302
  • https://router.infolinks.com/dyn/zeta-usync?uid=1875819619876477546
Request Chain 60
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YKLDpnDkyCfN7Fs1arCLtAAA HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm=&google_sc=&google_hm=YKLDpnDkyCfN7Fs1arCLtAAA&google_tc= HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOmwWzAdEPWikr4JQIm_nSs&google_cver=1&gdpr=1
Request Chain 61
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&dcc=t
Request Chain 63
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&gdpr_consent=&us_privacy=&gdpr=1&google_tc= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEAH8yMsqFXw69YKn5JD8ZUc&google_cver=1
Request Chain 64
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1623871655
Request Chain 67
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=1 HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=ofi4F6yi1LIITR5&gdpr=1

113 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.sawfirst.com/
Redirect Chain
  • http://www.sawfirst.com/
  • https://www.sawfirst.com/
48 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
b6c6cc7aa6d693762b0e5ee84740b0a4d2cf765de77fc4e9f6f212a7207d360e

Request headers

:method
GET
:authority
www.sawfirst.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
link
<https://www.sawfirst.com/wp-json/>; rel="https://api.w.org/" </wp-content/litespeed/cssjs/0fa76.css?7ef7e>; rel=preload; as=style
vary
Accept-Encoding
cache-control
public, max-age=0,public
expires
Sun, 16 May 2021 22:25:52 GMT
etag
"1895569-1621203952;br"
x-litespeed-cache
hit
content-encoding
br
content-length
6904
date
Mon, 17 May 2021 19:27:33 GMT
server
LiteSpeed
set-cookie
ls_smartpush=1; path=/; expires=Fri, 16 Jul 2021 19:27:33 GMT
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000

Redirect headers

Connection
Keep-Alive
Content-Type
text/html
Content-Length
705
Date
Mon, 17 May 2021 19:27:33 GMT
Server
LiteSpeed
Location
https://www.sawfirst.com/
Cache-Control
public
0fa76.css
www.sawfirst.com/wp-content/litespeed/cssjs/ 		69 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.sawfirst.com/wp-content/litespeed/cssjs/0fa76.css?7ef7e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
e9cd0faddcec01f98997264ee0265690499d4f7adede1fe651719c0a3d4d044b

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:33 GMT
content-encoding
br
last-modified
Sun, 16 May 2021 22:25:14 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
10817
expires
Tue, 17 May 2022 19:27:33 GMT
js
www.googletagmanager.com/gtag/ 		88 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-39697070-1
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
33fe875776c050561a122e39735246893419dbd61fd78d5991be4c82625c038f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:33 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35637
x-xss-protection
0
last-modified
Mon, 17 May 2021 18:34:37 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 May 2021 19:27:33 GMT
facebook-in.gif
www.sawfirst.com/ 		219 B
327 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/facebook-in.gif
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
fea721b7d25d7646e10655fdc461a3a98adf0598cd9e0ef273b08dd7f6cedf7b

Request headers

:path
/facebook-in.gif
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:33 GMT
last-modified
Wed, 10 Jul 2019 22:39:45 GMT
server
LiteSpeed
content-type
image/gif
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
219
expires
Wed, 16 Jun 2021 19:27:33 GMT
twitter-in.jpeg
www.sawfirst.com/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/twitter-in.jpeg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
53e60faa688b7a75e27878f5575b3bf4ff068c2ffc7a0094eac3546e31e87ffe

Request headers

:path
/twitter-in.jpeg
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Mon, 08 Jul 2019 18:03:38 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
2026
expires
Wed, 16 Jun 2021 19:27:34 GMT
pinterest-in.png
www.sawfirst.com/ 		890 B
979 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/pinterest-in.png
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
7b06a655db7277250b3fccf043fcf65f0710c93c4466699c88319187229ce24a

Request headers

:path
/pinterest-in.png
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Wed, 10 Jul 2019 22:39:50 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
890
expires
Wed, 16 Jun 2021 19:27:34 GMT
mail-in.png
www.sawfirst.com/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/mail-in.png
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
b0e675d8fcaec6e54624c3421ce55ca293bdd7757eb936708c778cbe4465cf0a

Request headers

:path
/mail-in.png
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Wed, 10 Jul 2019 22:39:47 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
1046
expires
Wed, 16 Jun 2021 19:27:34 GMT
display.php
www.onclickperformance.com/a/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.onclickperformance.com/a/display.php?r=2465775
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.55.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.55.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
2f7e329f3c48194be076086ff2df5b3472c345a893106021cbe7f3e2ab30c069

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
gzip
server
openresty
alt-svc
clear
via
1.1 google
content-type
application/javascript; charset=utf-8
display.php
www.onclickperformance.com/a/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.onclickperformance.com/a/display.php?r=3846727
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.55.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.55.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
7afd54d578b74f9a2cb539a8fbab691e79a4348badae7fe0de26674fa2a97469

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
gzip
server
openresty
alt-svc
clear
via
1.1 google
content-type
application/javascript; charset=utf-8
infolinks_main.js
resources.infolinks.com/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/infolinks_main.js
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6e0a6e1b2ea0ed56461a196a51c1cc33b81369d91de9e4a4123d7a47a2b1969

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray
650f3e6f6c179c0f-AMS
date
Mon, 17 May 2021 19:27:34 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Sun, 16 May 2021 04:16:19 GMT
server
cloudflare
age
11450
etag
W/"c46-5c26abd22f724"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=3600
content-encoding
gzip
cf-request-id
0a1d65599d00009c0f1535c000000001
expires
Mon, 17 May 2021 17:16:44 GMT
jquery.min.js
www.sawfirst.com/wp-includes/js/jquery/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sawfirst.com/wp-includes/js/jquery/jquery.min.js
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827

Request headers

:path
/wp-includes/js/jquery/jquery.min.js
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
br
last-modified
Thu, 10 Dec 2020 09:21:02 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
30287
expires
Tue, 17 May 2022 19:27:34 GMT
8eaba.js
www.sawfirst.com/wp-content/litespeed/cssjs/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sawfirst.com/wp-content/litespeed/cssjs/8eaba.js?55079
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
7f0644e1001c127a6b328acc18e9c4ea666f406d355cc78b167a251c64953857

Request headers

:path
/wp-content/litespeed/cssjs/8eaba.js?55079
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
br
last-modified
Sun, 16 May 2021 22:25:17 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
5875
expires
Tue, 17 May 2022 19:27:34 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		142 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ad8f73120d2a8f6bbb7f98704692e7cd28c153838abcd31a64aa5f98ee5b4e59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49889
x-xss-protection
0
server
cafe
etag
4995656317085212459
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 17 May 2021 19:27:33 GMT
Sarah-Stephens-in-Lingerie-17.jpg
www.sawfirst.com/wp-content/uploads/2021/05/ 		62 KB
62 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/wp-content/uploads/2021/05/Sarah-Stephens-in-Lingerie-17.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
d7f100a4a7ee1fb04b29965c4624c6f455bf69926cbe0a22d89f763cf412cc49

Request headers

:path
/wp-content/uploads/2021/05/Sarah-Stephens-in-Lingerie-17.jpg
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Sun, 16 May 2021 22:22:15 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
63839
expires
Wed, 16 Jun 2021 19:27:34 GMT
Emily-Ratajkowski-Leggy-501-scaled.jpg
www.sawfirst.com/wp-content/uploads/2021/05/ 		122 KB
122 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/wp-content/uploads/2021/05/Emily-Ratajkowski-Leggy-501-scaled.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
9cb61c345f9815344443e8bb9c29b86008c151dcb024837062cd14dbc77b81ca

Request headers

:path
/wp-content/uploads/2021/05/Emily-Ratajkowski-Leggy-501-scaled.jpg
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Sun, 16 May 2021 22:14:49 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
125310
expires
Wed, 16 Jun 2021 19:27:34 GMT
Rosie-Huntington-Whiteley-502-scaled.jpg
www.sawfirst.com/wp-content/uploads/2021/05/ 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/wp-content/uploads/2021/05/Rosie-Huntington-Whiteley-502-scaled.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
535785a82be044cdbf0542695ec14e3a36a0381a7f5a050e920bc49d4aaf1ec6

Request headers

:path
/wp-content/uploads/2021/05/Rosie-Huntington-Whiteley-502-scaled.jpg
pragma
no-cache
cookie
ls_smartpush=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Sun, 16 May 2021 11:40:16 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
89457
expires
Wed, 16 Jun 2021 19:27:34 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210511/r20190131/ Frame 1EF0 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20210511/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20210511/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.sawfirst.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.sawfirst.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sun, 16 May 2021 20:24:49 GMT
expires
Sun, 30 May 2021 20:24:49 GMT
content-type
text/html; charset=UTF-8
etag
10446291943670460780
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4644
x-xss-protection
0
age
82965
cache-control
public, max-age=1209600
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
native_render.js
superonclick.com/script/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://superonclick.com/script/native_render.js
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7965b4334f08b3c398843d721ab3b5535461f4183ec6bb0923d1ae092b9cfd51

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash
crc32c=rXethw==, md5=i4AdaMb2P574qaeqSEucdQ==
date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2940
x-guploader-uploadid
ABg5-Ux3ugDbjZHv9rpPo7PWt7S1qud12-Vw4b8rTYh-k2UMds-oGdb-EGzLhtVd-VxsPwU_T52pajAPwTcwsdI7qDL8U18q4g
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d6559d700004a85e4190000000001
last-modified
Wed, 13 Feb 2019 10:15:50 GMT
server
cloudflare
etag
W/"8b801d68c6f63f9ef8a9a7aa484b9c75"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pkIHaCvIz9fGYcKIUN%2BYeCBBJC4DyT6QujH0HXZpHUA%2Bmrr5l3F4p2eEbuZ9idkHMOO%2B2otzGVPtBQOGvqee17Yx7wTjHlaEJtFBGZfvsTBBCuUIGxVgQlC8HXap"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1550052950916101
access-control-allow-origin
*
content-type
application/javascript
cache-control
public, max-age=14400
x-goog-stored-content-length
4285
cf-ray
650f3e6fbd984a85-FRA
expires
Mon, 17 May 2021 18:50:25 GMT
native_server.js
superonclick.com/script/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://superonclick.com/script/native_server.js
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e282545f9f7c4117db91f8a2c33e5a1dad31f3c6edbe74b9776c1f8b85c166bd

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash
crc32c=RAjq/g==, md5=Udh+nr2DH8yragFgeaYHkw==
date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
862
x-guploader-uploadid
ABg5-UztHarEA9WAL61ya9rea4JSaKO43c4uJRU5ju3QmZnd8lU0dTs1xERvBaCgxHtc9Mw1kzkD_hnNAYAJCEBbKOXI6RQA2w
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d6559d800004a85793fd000000001
last-modified
Wed, 13 Feb 2019 10:15:52 GMT
server
cloudflare
etag
W/"51d87e9ebd831fccab6a016079a60793"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b0QHx%2FJ5ewuqxDIuXAdlVrZMiXEiu4sqTXEakS4lSDMdUnwkkYtWrmUoB5yflafeAdTBuG2tL7RF7KVj1bpHSyRPyTs0RRIEElBfT3WJi90MpNFSXLhDgGy4Ci1C"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1550052952705094
access-control-allow-origin
*
content-type
application/javascript
cache-control
public, max-age=14400
x-goog-stored-content-length
9260
cf-ray
650f3e6fbda04a85-FRA
expires
Mon, 17 May 2021 19:28:15 GMT
analytics.js
www.google-analytics.com/ 		48 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-39697070-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
3642
date
Mon, 17 May 2021 18:26:52 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Mon, 17 May 2021 20:26:52 GMT
collect
www.google-analytics.com/j/ 		1 B
25 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1312076566&t=pageview&_s=1&dl=https%3A%2F%2Fwww.sawfirst.com%2F&ul=en-us&de=UTF-8&dt=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=238963896&gjid=1031196666&cid=1366263518.1621279654&tid=UA-39697070-1&_gid=338329801.1621279654&_r=1&gtm=2ou5c1&z=543817876
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:34 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sawfirst.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
display.php
www.onclickperformance.com/ad/ Frame 8DC5 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2C8NiajY2JqB1dAN0dEdHP3xP.518%2CZMkKdRAQlkuDbgTABrav5A2p3doafuCDkjslrbo6QE-1x0i8I78m7lFPF8YQuUfeUt5_5ShnXnMtIAAHKDC7RnUBnmcimBPhm9YazYF4dDA%2C&cbrandom=0.7350881215455829&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
Requested by
Host: www.onclickperformance.com
URL: https://www.onclickperformance.com/a/display.php?r=2465775
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.55.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.55.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
b6807257488f55924ec855d8a87b495fc87a552eb30cf395c0953e932f921199

Request headers

:method
GET
:authority
www.onclickperformance.com
:scheme
https
:path
/ad/display.php?stamat=m%7C%2C8NiajY2JqB1dAN0dEdHP3xP.518%2CZMkKdRAQlkuDbgTABrav5A2p3doafuCDkjslrbo6QE-1x0i8I78m7lFPF8YQuUfeUt5_5ShnXnMtIAAHKDC7RnUBnmcimBPhm9YazYF4dDA%2C&cbrandom=0.7350881215455829&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.sawfirst.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.sawfirst.com/

Response headers

server
openresty
date
Mon, 17 May 2021 19:27:34 GMT
content-type
text/html; charset=utf-8
access-control-allow-origin
*
link
<//www.onclickperformance.com>; rel=dns-prefetch,<//www.onclickperformance.com>; rel=preconnect,<//bigwinpictures.com>; rel=dns-prefetch,<//bigwinpictures.com>; rel=preconnect
content-encoding
gzip
via
1.1 google
alt-svc
clear
Christine-McGuinness-509-scaled.jpg
www.sawfirst.com/wp-content/uploads/2021/05/ 		247 KB
247 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sawfirst.com/wp-content/uploads/2021/05/Christine-McGuinness-509-scaled.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.206.12.119 , United States, ASN29802 (HVC-AS, US),
Reverse DNS
66-206-12-119.static.hvvc.us
Software
LiteSpeed /
Resource Hash
407de28da1c39b7d37b5bded8b97297069fc9a7b3f93a0cef6ec9381f1283917

Request headers

:path
/wp-content/uploads/2021/05/Christine-McGuinness-509-scaled.jpg
pragma
no-cache
cookie
ls_smartpush=1; _ga=GA1.2.1366263518.1621279654; _gid=GA1.2.338329801.1621279654; _gat_gtag_UA_39697070_1=1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.sawfirst.com
referer
https://www.sawfirst.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Sun, 16 May 2021 11:23:26 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=2592000,public
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length
252555
expires
Wed, 16 Jun 2021 19:27:34 GMT
display.php
www.onclickperformance.com/ad/ Frame 1D0B 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2CgtjO-YiIqB1dAN0dEdHP3xP.cea%2CZMkKdRAQlkuDbgTABrav5O7Q77TZamOMI-XCDUXdq4ae8JFo5gQ3FJJhSQqsgGgArZrep_ioVelvL4_p7DaOhnhMnlgLDR1XT6LV7auXo5E%2C&cbrandom=0.2765018932972929&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
Requested by
Host: www.onclickperformance.com
URL: https://www.onclickperformance.com/a/display.php?r=3846727
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.55.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.55.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
35a3d91d677d31038cdcf5a5d786172617b786157ed7385d53b629e94ac9fc92

Request headers

:method
GET
:authority
www.onclickperformance.com
:scheme
https
:path
/ad/display.php?stamat=m%7C%2CgtjO-YiIqB1dAN0dEdHP3xP.cea%2CZMkKdRAQlkuDbgTABrav5O7Q77TZamOMI-XCDUXdq4ae8JFo5gQ3FJJhSQqsgGgArZrep_ioVelvL4_p7DaOhnhMnlgLDR1XT6LV7auXo5E%2C&cbrandom=0.2765018932972929&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.sawfirst.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.sawfirst.com/

Response headers

server
openresty
date
Mon, 17 May 2021 19:27:34 GMT
content-type
text/html; charset=utf-8
access-control-allow-origin
*
link
<//www.onclickperformance.com>; rel=dns-prefetch,<//www.onclickperformance.com>; rel=preconnect
content-encoding
gzip
via
1.1 google
alt-svc
clear
ice.js
resources.infolinks.com/js/1747.002-3.012/ 		588 KB
188 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/1747.002-3.012/ice.js
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ffa811ff2834d53f32832c8b70d7df7208264e144629487bbd91179ca13a5eca

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray
650f3e707c669c0f-AMS
date
Mon, 17 May 2021 19:27:34 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Mon, 10 May 2021 17:45:28 GMT
server
cloudflare
age
5300
etag
W/"9312d-5c1fd57dcd910"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
cf-request-id
0a1d655a4700009c0f15b21000000001
expires
Wed, 16 Jun 2021 17:59:14 GMT
pbice.js
resources.infolinks.com/js/pbice/3.012/ 		253 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/pbice/3.012/pbice.js
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1747.002-3.012/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef22755bc9501f967f1cb92530ea9a24c98432e12dfa2b35a71482b3e5579b21

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray
650f3e712c9b9c0f-AMS
date
Mon, 17 May 2021 19:27:34 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Thu, 25 Feb 2021 13:31:34 GMT
server
cloudflare
age
7103
etag
W/"3f394-5bc292b988e82"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
cf-request-id
0a1d655ab400009c0f321ad000000001
expires
Wed, 16 Jun 2021 17:29:11 GMT
manage
router.infolinks.com/usync/ Frame A157 		8 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1747.002-3.012/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
194098486a9bf0977a009766b5c8859531892768f34f1a6bca4797d31636a5f0

Request headers

:method
GET
:authority
router.infolinks.com
:scheme
https
:path
/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.sawfirst.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.sawfirst.com/

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-type
text/html;charset=UTF-8
cache-control
no-store
p3p
CP="NON DSP NID OUR COR"
via
1.1 google
cf-cache-status
DYNAMIC
cf-request-id
0a1d655acb00009c0f4439b000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
650f3e714ca59c0f-AMS
content-encoding
gzip
lcmanage
router.infolinks.com/usync/ 		0
77 B 		Script
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/usync/lcmanage?pid=3137868&wsid=0
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1747.002-3.012/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cache-control
no-store
cf-ray
650f3e715caf9c0f-AMS
content-length
0
cf-request-id
0a1d655ad900009c0f473ed000000001
identify.html
ufpcdn.com/script/ Frame 677D 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ufpcdn.com/script/identify.html?frmt=0
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/native_server.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:8e31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ffb16355784a4a89472be6cb28c3408234ec0518326a3a1908797b8d8c78a76a

Request headers

:method
GET
:authority
ufpcdn.com
:scheme
https
:path
/script/identify.html?frmt=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.sawfirst.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.sawfirst.com/

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-type
text/html
last-modified
Tue, 15 May 2018 06:39:25 GMT
cf-cache-status
DYNAMIC
cf-request-id
0a1d655aff00004e6721a5e000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
set-cookie
__cf_bm=6bb876a1198398f1e1ef336a38b2688e03ab476a-1621279654-1800-AWNhj1NEtov5qtB2gw0CYwbthrIZYfuJDLKkWHG1mbNzKEL6OwVkqoSWuTZPU03zza9YTK5FDxdDdZQ/KsVCUHw=; path=/; expires=Mon, 17-May-21 19:57:34 GMT; domain=.ufpcdn.com; HttpOnly; Secure; SameSite=None
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=QagMWXxRDmCAaZ%2FnnsV1kXcwrHzyxlPGx7V1Vcks4JtejyAfa8b0f5g%2FlylqZUX7hPpUQBo7fFUOzevKjFnA1DKsmruem9Aoes6g5xV8CxEwlcXhQbIC"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
650f3e7199ad4e67-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
ac62140d6fc82f6067a445bdeae43146_7375.png
crrepo.com/extban/257515620/creatives/23259954/ Frame 8DC5 		53 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://crrepo.com/extban/257515620/creatives/23259954/ac62140d6fc82f6067a445bdeae43146_7375.png
Requested by
Host: www.onclickperformance.com
URL: https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2C8NiajY2JqB1dAN0dEdHP3xP.518%2CZMkKdRAQlkuDbgTABrav5A2p3doafuCDkjslrbo6QE-1x0i8I78m7lFPF8YQuUfeUt5_5ShnXnMtIAAHKDC7RnUBnmcimBPhm9YazYF4dDA%2C&cbrandom=0.7350881215455829&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:eb72 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7b5d3864935f0dcfc7e5e91685cd48b80af3ff58b224a51f621d27eb04dfd0b

Request headers

Referer
https://www.onclickperformance.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
via
1.1 google
cf-cache-status
REVALIDATED
last-modified
Wed, 21 Apr 2021 12:22:17 GMT
server
cloudflare
etag
W/"608018f9-d360"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5c%2FdNNQu4LXPp7Zu%2Fyz%2BrjgOhMXWgL1WJ3uOCjrlIQY0mVytVU%2B9Nid41OKhr1kvCH8C1pqZwmXAJqW%2FYNa2mm2upq6D6gC1V0wOfS6xErW0yUNJhf3f"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
nel
{"report_to":"cf-nel","max_age":604800}
cf-ray
650f3e71cdae325c-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655b190000325c26018000000001
1_scene
pt.potawe.com/avb/straight/hardcore/ Frame 096C 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Requested by
Host: www.onclickperformance.com
URL: https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2CgtjO-YiIqB1dAN0dEdHP3xP.cea%2CZMkKdRAQlkuDbgTABrav5O7Q77TZamOMI-XCDUXdq4ae8JFo5gQ3FJJhSQqsgGgArZrep_ioVelvL4_p7DaOhnhMnlgLDR1XT6LV7auXo5E%2C&cbrandom=0.2765018932972929&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
93.93.51.191 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
unknown /
Resource Hash
176b5ee76d22d0a81ca09ada4e629177160e7ebbf72c2f25c64da4bcf5e37128

Request headers

:method
GET
:authority
pt.potawe.com
:scheme
https
:path
/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.onclickperformance.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.onclickperformance.com/

Response headers

content-type
text/html; charset=UTF-8
vary
Accept-Encoding
cache-control
no-cache
date
Mon, 17 May 2021 19:27:34 GMT
server
unknown
x-real-source
-
set-cookie
psui=a8895b35c18b602478a21ff801b34b42; Path=/; Expires=Wed, 16-Jun-21 19:27:34 GMT; SameSite=None; Secure
content-encoding
gzip
/
de.tynt.com/deb/ Frame F4B5 		75 B
289 B 		Document
General
Check archive.org
Download Go to
Full URL
https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.183 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip183.208-100-17.static.steadfastdns.net
Software
/
Resource Hash
e170d20dbbd5a22f50118e25fa2eefb1e85d2ad780e5477ed3a9643186090442

Request headers

:method
GET
:authority
de.tynt.com
:scheme
https
:path
/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://router.infolinks.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://router.infolinks.com/

Response headers

cache-control
max-age=86400
expires
Tue, 18 May 2021 19:27:35 GMT
referrer-policy
unsafe-url
content-type
text/html
content-length
75
date
Mon, 17 May 2021 19:27:34 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
Cookie set usermatch
ssum-sec.casalemedia.com/ Frame 73C1
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
deb5719528aa2668cab2f8a72b98cf225529d2fb2ab9f49a4f02481d6b204619

Request headers

Host
ssum-sec.casalemedia.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://router.infolinks.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
CMID=YKLDpnDkyCfN7Fs1arCLtAAA; CMPS=3164
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://router.infolinks.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
45|241|39|230|64|188|191|47
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1740
Expires
Mon, 17 May 2021 19:27:34 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Mon, 17 May 2021 19:27:34 GMT
Connection
keep-alive
Set-Cookie
CMID=YKLDpnDkyCfN7Fs1arCLtAAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Tue, 17 May 2022 19:27:34 GMT CMPS=3164;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 15 Aug 2021 19:27:34 GMT CMPRO=1180;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 15 Aug 2021 19:27:34 GMT CMST=YKLDpmCiw6YA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Tue, 18 May 2021 19:27:34 GMT CMRUM3=2f60a2c3a605a0&bf60a2c3a605a0&f160a2c3a605a0&e660a2c3a62760&2d60a2c3a605a0&2760a2c3a60b40&4060a2c3a605a0&bc60a2c3a605a00;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Tue, 17 May 2022 19:27:34 GMT

Redirect headers

Server
Apache
Content-Length
311
Content-Type
text/html; charset=iso-8859-1
Location
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires
Mon, 17 May 2021 19:27:34 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Mon, 17 May 2021 19:27:34 GMT
Connection
keep-alive
Set-Cookie
CMID=YKLDpnDkyCfN7Fs1arCLtAAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Tue, 17 May 2022 19:27:34 GMT CMPS=3164;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 15 Aug 2021 19:27:34 GMT
/
onetag-sys.com/usync/ Frame D9EC 		2 KB
818 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip252.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

:method
GET
:authority
onetag-sys.com
:scheme
https
:path
/usync/?pubId=598ce3ddaee8c90
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://router.infolinks.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://router.infolinks.com/

Response headers

content-type
text/html
cache-control
no-transform, no-cache
content-encoding
gzip
strict-transport-security
max-age=15552000
pbm-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Qzk3MzBBMTctQkI3Ri00QjE2LTkwNzktQkNDQ0YwQTRENEY5&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Qzk3MzBBMTctQkI3Ri00QjE2LTkwNzktQkNDQ0YwQTRENEY5&gdpr=0&gdpr_consent=&google_tc=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DC9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
  • https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
0
67 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
text/html;charset=UTF-8
cache-control
no-store, no-cache, private
cf-ray
650f3e762e209c0f-AMS
content-length
0
cf-request-id
0a1d655ddd00009c0f36a90000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
Date
Mon, 17 May 2021 18:00:30 GMT
Cache-Control
no-store, no-cache, private
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
apn-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID
  • https://router.infolinks.com/dyn/apn-usync?user_id=5680856009878954723
35 B
213 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/apn-usync?user_id=5680856009878954723
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e737d4c9c0f-AMS
content-length
35
cf-request-id
0a1d655c2900009c0f15b2a000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:34 GMT
X-Proxy-Origin
185.212.171.67; 185.212.171.67; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.41:80
AN-X-Request-Uuid
f617b7b9-1ed4-4733-aea0-c5af17e52d17
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://router.infolinks.com/dyn/apn-usync?user_id=5680856009878954723
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
VR-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58422/occ
  • https://ups.analytics.yahoo.com/ups/58422/occ?verify=true
  • https://router.infolinks.com/dyn/VR-usync?uid=y-MPoWERdE2uErF0CYrntgErahaFQvLpA6ebR0Mb4-~A
35 B
233 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/VR-usync?uid=y-MPoWERdE2uErF0CYrntgErahaFQvLpA6ebR0Mb4-~A
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e737d4d9c0f-AMS
content-length
35
cf-request-id
0a1d655c2a00009c0f22918000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Date
Mon, 17 May 2021 19:27:34 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://router.infolinks.com/dyn/VR-usync?uid=y-MPoWERdE2uErF0CYrntgErahaFQvLpA6ebR0Mb4-~A
Connection
keep-alive
Content-Length
0
r1-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://sync.1rx.io/usersync2/infolinks
  • https://router.infolinks.com/dyn/r1-usync?uid=OPTOUT
35 B
272 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/r1-usync?uid=OPTOUT
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:34 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e731d339c0f-AMS
content-length
35
cf-request-id
0a1d655bee00009c0f2514c000000001
expires
Sun, 17 May 2020 19:27:34 GMT

Redirect headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:34 GMT
server
Tengine
etag
OPTOUT
content-type
text/html
location
https://router.infolinks.com/dyn/r1-usync?uid=OPTOUT
cache-control
no-store, no-cache, must-revalidate
expires
0
zmn-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
  • https://router.infolinks.com/dyn/zmn-usync?uid=
35 B
203 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/zmn-usync?uid=
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e74eda69c0f-AMS
content-length
35
cf-request-id
0a1d655d1400009c0f2b151000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/zmn-usync?uid=
Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
70
Content-Type
text/html; charset=utf-8
us
sync.go.sonobi.com/ Frame A157 		0
474 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:34 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
ca.png
s.cpx.to/ Frame A157
Redirect Chain
  • https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fwww.sawfirst.com%252F&pid=12306&adnxs_uid=$UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttps%25253A%25252F%25252Fwww.sawfirst.com%25252F%26pid%3D12306%26adnxs_uid%3D%24UID
  • https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.sawfirst.com%2F&pid=12306&adnxs_uid=5680856009878954723
95 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.sawfirst.com%2F&pid=12306&adnxs_uid=5680856009878954723
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.124.7 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-124-7.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache, no-cache
Content-Security-Policy
default-src 'self'
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Date
Mon, 17 May 2021 19:27:35 GMT
X-Frame-Options
sameorigin
Connection
keep-alive
P3P
CP="NOI DEV ADM"
Cache-Control
no-store, must-revalidate, private, max-age=0, no-store, must-revalidate, private, max-age=0
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/png
Content-Length
95
Expires
Mon, 17 May 2021 19:27:35 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:34 GMT
X-Proxy-Origin
185.212.171.67; 185.212.171.67; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.153:80
AN-X-Request-Uuid
4cadf355-c216-4075-93d8-f7a103432b1d
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.sawfirst.com%2F&pid=12306&adnxs_uid=5680856009878954723
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
dsp.adkernel.com/ Frame A157 		42 B
233 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsp.adkernel.com/sync?exchange=202&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fearn-usync%3Fuid%3D%7BUID%7D
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Server
nginx
Age
0
Content-Type
image/gif
Cache-Control
no-store
Connection
keep-alive
Content-Length
42
outh-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPee9d88d1-b745-11eb-a180-0221adc671b4
  • https://router.infolinks.com/dyn/outh-usync?uid=y-YE6TRwRE2uEp281Js4SUP8LT8G3SxkqO~A~UPee9d88d1-b745-11eb-a180-0221adc671b4
35 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/outh-usync?uid=y-YE6TRwRE2uEp281Js4SUP8LT8G3SxkqO~A~UPee9d88d1-b745-11eb-a180-0221adc671b4
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e73ed759c0f-AMS
content-length
35
cf-request-id
0a1d655c7500009c0f443a5000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Date
Mon, 17 May 2021 19:27:35 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://router.infolinks.com/dyn/outh-usync?uid=y-YE6TRwRE2uEp281Js4SUP8LT8G3SxkqO~A~UPee9d88d1-b745-11eb-a180-0221adc671b4
Connection
keep-alive
Content-Length
0
usersync
match.bnmla.com/ Frame A157 		0
114 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.bnmla.com/usersync?sspid=1000361&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fenbd-usync%3Fuid%3D%5BUUID%5D
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
38.27.122.126 , United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 19:27:35 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
sovrn-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
  • https://router.infolinks.com/dyn/sovrn-usync?uid=aaff1fbdd30bcda3cd76a78f
35 B
219 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/sovrn-usync?uid=aaff1fbdd30bcda3cd76a78f
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e73bd659c0f-AMS
content-length
35
cf-request-id
0a1d655c5800009c0f1c1fe000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Date
Mon, 17 May 2021 19:27:34 GMT
Server
nginx
Location
https://router.infolinks.com/dyn/sovrn-usync?uid=aaff1fbdd30bcda3cd76a78f
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap6ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
0
pbm-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUNERDRERUYtQTE5MC00MTA1LTk4RDItQzM5RURCOTVCNjFE&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUNERDRERUYtQTE5MC00MTA1LTk4RDItQzM5RURCOTVCNjFE&gdpr=0&gdpr_consent=&google_tc=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DC9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
  • https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
0
193 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
text/html;charset=UTF-8
cache-control
no-store, no-cache, private
cf-ray
650f3e760e159c0f-AMS
content-length
0
cf-request-id
0a1d655dc200009c0f2003e000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/pbm-usync?uid=C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
Date
Mon, 17 May 2021 18:01:08 GMT
Cache-Control
no-store, no-cache, private
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
iq-usync
router.infolinks.com/dyn/ Frame A157 		0
140 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/iq-usync
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cache-control
no-store
cf-ray
650f3e73ed6c9c0f-AMS
content-length
0
cf-request-id
0a1d655c7000009c0f168f8000000001
zeta-usync
router.infolinks.com/dyn/ Frame A157
Redirect Chain
  • https://p.rfihub.com/cm?pub=43153&in=1
  • https://router.infolinks.com/dyn/zeta-usync?uid=1875819619876477546
35 B
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/zeta-usync?uid=1875819619876477546
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e74cda09c0f-AMS
content-length
35
cf-request-id
0a1d655d0200009c0f4094d000000001
expires
Sun, 17 May 2020 19:27:35 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/zeta-usync?uid=1875819619876477546
Date
Mon, 17 May 2021 19:27:35 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
/
ssc-cms.33across.com/ps/ Frame A157 		0
89 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3137868&wsid=0&pdom=www.sawfirst.com&purl=https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.110.23 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip23.67-202-110.static.steadfastdns.net
Software
33XP005 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-33x-status
200000000000000002000208
date
Mon, 17 May 2021 19:27:35 GMT
server
33XP005
advertisement-v754389.js
pt-static4.ptwmstc.com/_common/script/adblock/ Frame 096C 		21 B
208 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pt-static4.ptwmstc.com/_common/script/adblock/advertisement-v754389.js
Requested by
Host: pt.potawe.com
URL: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
93.93.51.200 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
unknown /
Resource Hash
e97a9988dce8067f81f57557b349dd481e0335e75175179b6b01322be2ff13a5

Request headers

Referer
https://pt.potawe.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Mon, 17 May 2021 08:05:05 GMT
server
unknown
etag
"60a223b1-15"
x-cache-status
R-HIT
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
21
avb-animation-06-v754389.css
pt-static5.ptwmstc.com/ba/avb/css/ Frame 096C 		15 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://pt-static5.ptwmstc.com/ba/avb/css/avb-animation-06-v754389.css
Requested by
Host: pt.potawe.com
URL: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
93.93.51.200 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
unknown /
Resource Hash
fe33d94f16ddc49eae38e103925f71767c405175987cefa4eb771300fff9d7f2

Request headers

Referer
https://pt.potawe.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 08:05:06 GMT
server
unknown
etag
W/"60a223b2-3dcd"
x-cache-status
R-HIT
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
avb-main-v754389.js
pt-static3.ptwmstc.com/ba/avb/script/ Frame 096C 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pt-static3.ptwmstc.com/ba/avb/script/avb-main-v754389.js
Requested by
Host: pt.potawe.com
URL: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
93.93.51.200 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
unknown /
Resource Hash
087461f044d6f216bc883207c3a7d00c91a5c7288733938649a26edc324509e8

Request headers

Referer
https://pt.potawe.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 08:05:06 GMT
server
unknown
etag
W/"60a223b2-a4f2"
x-cache-status
R-HIT
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
avb-font-based-v754389.js
pt-static4.ptwmstc.com/ba/avb/script/ Frame 096C 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pt-static4.ptwmstc.com/ba/avb/script/avb-font-based-v754389.js
Requested by
Host: pt.potawe.com
URL: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
93.93.51.200 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
unknown /
Resource Hash
73904e3a3d5061153f12915315b32ebb7f12051019bac2abe7de1988b86d9338

Request headers

Referer
https://pt.potawe.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 08:05:06 GMT
server
unknown
etag
W/"60a223b2-275a"
x-cache-status
R-HIT
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
naF.gif
pt.potawe.com/xJrZV/ Frame 096C 		43 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pt.potawe.com/xJrZV/naF.gif?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jsm&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Requested by
Host: pt.potawe.com
URL: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
93.93.51.191 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
unknown /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
unknown
content-type
image/gif
cache-control
no-cache
x-real-source
-
content-length
43
expires
Mon, 17 May 2021 19:27:33 GMT
gtm.js
www.googletagmanager.com/ Frame 096C 		103 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WXTGF28
Requested by
Host: pt.potawe.com
URL: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8bdb5b7c1e4af7700a29d6d9ad7506834fcfad11d4c221ba11fcaf1d7959598b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://pt.potawe.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35924
x-xss-protection
0
last-modified
Mon, 17 May 2021 18:34:37 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 May 2021 19:27:34 GMT
native.php
discovernative.com/script/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/native.php?nwpsv=1&r=3840087&cbrandom=0.24715136285889172&cbWidth=1600&cbHeight=1200&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbref=&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbiframe=0&&callback=jsonp530841
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
60975a642a438f8cf3a1d5c565f6e7cba96143bb2ebf1c1d6efeb9cb11f08c16

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
gzip
alt-svc
clear
server
openresty
content-type
application/json; charset=utf-8
access-control-allow-origin
*
link
<//discovernative.com>; rel=dns-prefetch,<//discovernative.com>; rel=preconnect,<//cdnativ.com>; rel=dns-prefetch,<//cdnativ.com>; rel=preconnect
via
1.1 google
native.php
discovernative.com/script/ 		8 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/native.php?nwpsv=1&r=3843963&cbrandom=0.6982183742089632&cbWidth=1600&cbHeight=1200&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbref=&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbiframe=0&&callback=jsonp905244
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
c29bf01b2caef00c02b7f73d58fb2eec46ce862a5b174111343a3147d56f4446

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
content-encoding
gzip
alt-svc
clear
server
openresty
content-type
application/json; charset=utf-8
access-control-allow-origin
*
link
<//discovernative.com>; rel=dns-prefetch,<//discovernative.com>; rel=preconnect,<//cdnativ.com>; rel=dns-prefetch,<//cdnativ.com>; rel=preconnect
via
1.1 google
native.php
discovernative.com/script/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/native.php?nwpsv=1&r=3840087&cbrandom=0.09731233115264426&cbWidth=1600&cbHeight=1200&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbref=&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbiframe=0&&ufp=16087852919722895121740344843&callback=jsonp918660
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
0d9b5032fb29eb6183213ab6e54ce3bfe2ba4d289e33abfd0fe5cca8e61d9b1e

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
content-encoding
gzip
alt-svc
clear
server
openresty
content-type
application/json; charset=utf-8
access-control-allow-origin
*
link
<//discovernative.com>; rel=dns-prefetch,<//discovernative.com>; rel=preconnect,<//cdnativ.com>; rel=dns-prefetch,<//cdnativ.com>; rel=preconnect
via
1.1 google
native.php
discovernative.com/script/ 		8 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/native.php?nwpsv=1&r=3843963&cbrandom=0.4397877942787556&cbWidth=1600&cbHeight=1200&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbref=&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbiframe=0&&ufp=16087852919722895121740344843&callback=jsonp268632
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
a5dd6c5de9e86796602a60c031ffe3dd6e7b66bc0129bff6054baedc9f4c3080

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
content-encoding
gzip
alt-svc
clear
server
openresty
content-type
application/json; charset=utf-8
access-control-allow-origin
*
link
<//discovernative.com>; rel=dns-prefetch,<//discovernative.com>; rel=preconnect,<//cdnativ.com>; rel=dns-prefetch,<//cdnativ.com>; rel=preconnect
via
1.1 google
bebasneue_bold-webfont-v754389.woff
pt-static5.ptwmstc.com/_common/fonts/ Frame 096C 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://pt-static5.ptwmstc.com/_common/fonts/bebasneue_bold-webfont-v754389.woff
Requested by
Host: pt-static5.ptwmstc.com
URL: https://pt-static5.ptwmstc.com/ba/avb/css/avb-animation-06-v754389.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
93.93.51.200 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
unknown /
Resource Hash
aef6b1a90384cb7b24f4698b86ef2aa72a511a2f9cafa6e6ae3f695c147b4541

Request headers

Origin
https://pt.potawe.com
Referer
https://pt-static5.ptwmstc.com/ba/avb/css/avb-animation-06-v754389.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:34 GMT
last-modified
Mon, 17 May 2021 08:05:05 GMT
server
unknown
etag
"60a223b1-5004"
x-cache-status
R-HIT
content-type
application/font-woff
access-control-allow-origin
*
accept-ranges
bytes
content-length
20484
c6c0d763c3ac1620ea263ed39236a30f.mp4
galleryn2.awemdia.com/f8d2e11bd6c43618af00d6f28c91232a13/ Frame 096C 		3 MB
3 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://galleryn2.awemdia.com/f8d2e11bd6c43618af00d6f28c91232a13/c6c0d763c3ac1620ea263ed39236a30f.mp4?pstool=501_101&psid=adcash
Requested by
Host: pt.potawe.com
URL: https://pt.potawe.com/avb/straight/hardcore/1_scene?targetCategory=girl&landingTarget=randomchat&width=336&height=280&psid=adcash&tags=&filters=&banner=06&pstool=501_101&site=jasmin&cobrandId=&psprogram=revs&campaign_id=&subAffId=16212796543117722435054892587495665
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
93.93.51.190 , Luxembourg, ASN34655 (DOCLER-AS, LU),
Reverse DNS
Software
nginx /
Resource Hash
6932f2e4acbedd39e9c46b1e3f85d8e8b0666d5d99d5940fb4fd8da935f5c09c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pt.potawe.com/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=0-

Response headers

x-cdn-node
nlams
date
Mon, 17 May 2021 19:27:34 GMT
x-content-type-options
nosniff
last-modified
Wed, 03 Mar 2021 12:53:25 GMT
server
nginx
access-control-allow-origin
*
etag
"8f178f64d52c8616ee81d55986b91d5f"
x-cache-status
R-HIT
content-type
video/mp4
Content-Range
bytes 0-2654901/2654902
cache-control
max-age=1209600
x-real-source
-
Content-Length
2654902
expires
Mon, 31 May 2021 19:27:34 GMT
crum
dsum-sec.casalemedia.com/ Frame 73C1
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YKLDpnDkyCfN7Fs1arCLtAAA
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm=&google_sc=&google_hm=YKLDpnDkyCfN7Fs1arCLtAAA&google_tc=
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOmwWzAdEPWikr4JQIm_nSs&google_cver=1&gdpr=1
43 B
1015 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOmwWzAdEPWikr4JQIm_nSs&google_cver=1&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 17 May 2021 19:27:35 GMT

Redirect headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOmwWzAdEPWikr4JQIm_nSs&google_cver=1&gdpr=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
325
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 73C1
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&dcc=t
43 B
433 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.21.206.140 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
206-140.amazon.com
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Server
Server
Vary
User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Server
Server
Vary
User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame 73C1 		70 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_dsp_id=39&cm_user_id=YKLDpnDkyCfN7Fs1arCLtAAA&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usermatchredir
ssum-sec.casalemedia.com/ Frame 73C1
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&gdpr_consent=&us_privacy=&gdpr=1
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=YKLDpnDkyCfN7Fs1arCLtAAABJwAAAIB&gdpr_consent=&us_privacy=&gdpr=1&google_tc=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEAH8yMsqFXw69YKn5JD8ZUc&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEAH8yMsqFXw69YKn5JD8ZUc&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Mon, 17 May 2021 19:27:35 GMT

Redirect headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEAH8yMsqFXw69YKn5JD8ZUc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 73C1
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48&gdpr=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1623871655
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1623871655
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 17 May 2021 19:27:35 GMT

Redirect headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:34 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1623871655
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
CookieIndex
rtb.adentifi.com/ Frame 73C1 		0
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adentifi.com/CookieIndex
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.202.1.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-1-196.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
0
Content-Type
text/plain
index
dmp.brand-display.com/cm/api/ Frame 73C1 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3CIndex_user_id%3E&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.40.233 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
233.40.241.35.bc.googleusercontent.com
Software
nginx/1.20.0 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
last-modified
Mon, 17 May 2021 19:27:35 GMT
server
nginx/1.20.0
content-type
image/gif
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
alt-svc
clear
content-length
43
expires
Mon, 17 May 2021 19:27:36 GMT
crum
dsum-sec.casalemedia.com/ Frame 73C1
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=1
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=ofi4F6yi1LIITR5&gdpr=1
43 B
988 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=ofi4F6yi1LIITR5&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:35 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 17 May 2021 19:27:35 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 17 May 2021 19:27:34 GMT
Server
PingMatch/v2.0.30-649-g03fe1b8#rel-ec2-master i-06dc1c09a183d011e@eu-central-1b@dxedge-app-eu-central-1-prod-asg
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=ofi4F6yi1LIITR5&gdpr=1
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
ix-usync
router.infolinks.com/dyn/ Frame 73C1 		35 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/ix-usync?uid=YKLDpnDkyCfN7Fs1arCLtAAA%261180
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.22.3.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
650f3e737d4f9c0f-AMS
content-length
35
cf-request-id
0a1d655c2a00009c0f1536d000000001
expires
Sun, 17 May 2020 19:27:35 GMT
analytics.js
www.google-analytics.com/ Frame 096C 		48 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WXTGF28
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://pt.potawe.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
7058
date
Mon, 17 May 2021 17:29:56 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Mon, 17 May 2021 19:29:56 GMT
style.js
superonclick.com/script/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://superonclick.com/script/style.js
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/native_render.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
07e8d6ea069f651d48ad47731cce6d24417176b3a353554f40fe2d5f8b81afb1

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash
crc32c=r+9kWg==, md5=9vnEM2N/er/68OuRi4OHTA==
date
Mon, 17 May 2021 19:27:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3430
x-guploader-uploadid
ABg5-UzK_ZrcCVCauhLePG--Ux2MRLyyQJZxsdzL8wMGFtGjRkADxsXRV1k5UyXdBNmy1pYbs-Qcn8Ok0VglbFSByPRdJdq_qQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655c8100001f4d8ca4a000000001
last-modified
Thu, 10 Oct 2019 07:15:34 GMT
server
cloudflare
etag
W/"f6f9c433637f7abffaf0eb918b83874c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0usTY3fYV%2F2JljADMIxmz6f6cfBuNU4UKpL7Y0%2B0GslBNa6GepAWmXjYnHK7jtU9DYQNoxQK2wD2RF%2B%2Bom%2FC6TCEy9tbe4D4X4o6N4vDSf5A90Kpw1aeb%2BsA7bTF"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1570691734888336
access-control-allow-origin
*
content-type
text/javascript
cache-control
public, max-age=14400
x-goog-stored-content-length
41280
cf-ray
650f3e740ef61f4d-FRA
expires
Mon, 17 May 2021 19:04:28 GMT
146d09cbf42ede93bc58bb6a302384db_6629.jpeg
cdnativ.com/extban/216329220/creatives/23055168/ 		82 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055168/146d09cbf42ede93bc58bb6a302384db_6629.jpeg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5121c6c9f15405ea739bfd8af98eb9e2939dfa827c474dac27426b430fd04ce8

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6333
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655cdc00000621c9073000000001
last-modified
Mon, 08 Jun 2020 10:02:51 GMT
server
cloudflare
etag
W/"5ede0ccb-1481e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=85So%2BHarc4bSmxdqlndt6oQWjIx%2F%2BKIANwIVYmg5oasuwKKUsyTgsT5WqAusZWS4XLMfVHr%2FGNZDXmtud1v80iafzPHIvLVMpePPmBVMpPsCJfnlsokQCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e749dd40621-FRA
b12967d445bce336770b4d9d8029ab16_5060.jpg
cdnativ.com/extban/240842820/creatives/23185372/ 		44 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185372/b12967d445bce336770b4d9d8029ab16_5060.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e0ae61c5e4db1e6ed548f94681b517c9799258a4a1231b5d1d24f0809ca86b

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5049
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655cdc00000621a3150000000001
last-modified
Tue, 24 Nov 2020 13:15:38 GMT
server
cloudflare
etag
W/"5fbd077a-b0ec"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1f4NNl8JgKZqrueuVNtG9FisVxWOknKS4OgaFik7VG1vY4zz%2FrYYoPFPtC3fEYe55K5NPFhQX%2FgROivRQz%2FplvjxjJ%2F0QJQ4qPneeg92XSihTfKQ%2Fg5R%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e749dd60621-FRA
4bc62f4818318c4787e228f0b5d789b9_2031.jpg
cdnativ.com/extban/240842820/creatives/23185376/ 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185376/4bc62f4818318c4787e228f0b5d789b9_2031.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7a270a78749419a52e1a6e3170d5eca54bf96be37ac87f1242cac51a197d8c7

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6226
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655cdd00000621873b7000000001
last-modified
Tue, 24 Nov 2020 13:17:45 GMT
server
cloudflare
etag
W/"5fbd07f9-e721"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aZzwlYoYWnU0XlnAL1hD6z%2BnPXUa1SRbQwjffzen1LsEJDk4GCLmXQ917aivcR8eqzTiGsLMPGZJ5CxRtXlTCLLEruJCFopGgrZYJEZHzRV%2FApDv4MB9qQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e749dd70621-FRA
9728faf5e1ee67b2138b0c8923878c15_6081.jpg
cdnativ.com/extban/240842820/creatives/23185374/ 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185374/9728faf5e1ee67b2138b0c8923878c15_6081.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85a798dbaf61d64cf6f6bf7d0ca57de472b5d15ffa3ed24bfaccaa66870ee5a5

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1030
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655cdd00000621c9832000000001
last-modified
Tue, 24 Nov 2020 13:16:38 GMT
server
cloudflare
etag
W/"5fbd07b6-9b3a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cVyf77hvCm%2Feyu1yUZiZsi4Zm7%2BCJlZ5IWjdwhY25MR7fo2sv7xvsm7612jOVC3IGZEQ9rT0KeB7mtXnmLRWHBjd42Ri4L7w0bgGrCVjYqjJBH1WUivU%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e749dd80621-FRA
truncated
/ 		350 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3c41f4da5f7d6569364d3f152d18ab9875d24b8d65b88a51349722676fc96eed

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 21AC 		350 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3c41f4da5f7d6569364d3f152d18ab9875d24b8d65b88a51349722676fc96eed

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
146d09cbf42ede93bc58bb6a302384db_6629.jpeg
cdnativ.com/extban/216329220/creatives/23055168/ Frame 21AC 		82 KB
83 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055168/146d09cbf42ede93bc58bb6a302384db_6629.jpeg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5121c6c9f15405ea739bfd8af98eb9e2939dfa827c474dac27426b430fd04ce8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6333
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655d7f0000c2e027018000000001
last-modified
Mon, 08 Jun 2020 10:02:51 GMT
server
cloudflare
etag
W/"5ede0ccb-1481e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3kIqL9dkANGnKlhUnztgyn%2FwmsklGuNxycoMopr4zoa2H%2BmDuJXz0O4jtav5DRfalHxPNbGeHySV4L78ta0UfcG2haxjyn8OhZntczP5ETJZgVVqgM178Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e759889c2e0-FRA
b12967d445bce336770b4d9d8029ab16_5060.jpg
cdnativ.com/extban/240842820/creatives/23185372/ Frame 21AC 		44 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185372/b12967d445bce336770b4d9d8029ab16_5060.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e0ae61c5e4db1e6ed548f94681b517c9799258a4a1231b5d1d24f0809ca86b

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5049
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655d7e0000c2e0f298e000000001
last-modified
Tue, 24 Nov 2020 13:15:38 GMT
server
cloudflare
etag
W/"5fbd077a-b0ec"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5pcmXTwZ04rOEWaB4ACfGCNfZiIA4Gp9zA7cwji%2BFqKJBZWSVWu32kB1giXXJKFGS9%2FV9qDZb2Nri5xjPTLdrhH8DP4Adx58SZ1OuvRKvd%2BjVzlBI%2Bp4uw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e759885c2e0-FRA
4bc62f4818318c4787e228f0b5d789b9_2031.jpg
cdnativ.com/extban/240842820/creatives/23185376/ Frame 21AC 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185376/4bc62f4818318c4787e228f0b5d789b9_2031.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7a270a78749419a52e1a6e3170d5eca54bf96be37ac87f1242cac51a197d8c7

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6226
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655d7e0000c2e02994a000000001
last-modified
Tue, 24 Nov 2020 13:17:45 GMT
server
cloudflare
etag
W/"5fbd07f9-e721"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=n%2B%2F9Uu4gqaC%2F2ESg8uQRR48c8zXeGv%2FK7cytrLykmD2KAPxUuzEhKEvPxXTcjHdE0MOaaPR6Ja6H%2B6mPNdXYau4eJiFC77HMsIf772JYecRcPHhmk9YUGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e759884c2e0-FRA
9728faf5e1ee67b2138b0c8923878c15_6081.jpg
cdnativ.com/extban/240842820/creatives/23185374/ Frame 21AC 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185374/9728faf5e1ee67b2138b0c8923878c15_6081.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85a798dbaf61d64cf6f6bf7d0ca57de472b5d15ffa3ed24bfaccaa66870ee5a5

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1030
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655d7e0000c2e0180a9000000001
last-modified
Tue, 24 Nov 2020 13:16:38 GMT
server
cloudflare
etag
W/"5fbd07b6-9b3a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dDb%2B%2FjRBw%2BvJVOQYr6Ickf46zJfALbIO8FZ%2FCbM8NlOVynkJNyq7d%2BzrVPRlaAvcWYjNoSlA8xe6Dtni8tfWCBRWqvUkF00cZDTwvPy%2B3WK9nUzbP%2F8SPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e75987dc2e0-FRA
i.php
discovernative.com/script/ Frame 21AC 		0
61 B 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/i.php?stamat=m%7C%2C%2Cw3fz4jMmtGU3BJ-GH0dEdHP3xP.7ef%2CtamV1PbPAk_-OKMhStb5g0ic0ZxsKjamaruQSSbUHm3yDg2L7mvHU5ODAXBMAdWpWgX1kkuyMkZwFPG12lgMhlg5n5nZ-s89cacnuD2ecyT4fu80xgUsjMTZSt7Frw8Ly2dkESC-7AMNfoenXu-FR0p-S2zgPfxskPaEP7MSPcFJOiXMgWcBNHucC4MySVmg4Wgk7fHydmUKxJhXI-6ht2e1eFb2Q6Q_pdznU62n3SzKh5K3aUyqKKJTAlpgbs5aHlWb6VC-XIRxqyprq6B0ZcDqPJIW9lSyV5_zFz0nEb1M5K5H0GKJ7CBpIaaWa1SrRGSeReOe6X6TZO6bijohZK-qF8Dp5OCF4rLHFq97By6TJGjj42OXBBwDRTXfdCRTsVEzw0_8avbgrjnHKIXU9DCt1Q6L9XX24s_xd7DnOauFQE2VwCASR4nAjNSVkgp7yFx72CnFqhQdIVZNlO0kMci8wqri0e1XP2qGbC3IXM8Tzv_ecvpp0LuiccCLW0Cyppza_hdpWq_NKnGYBhgZXxW0eZAii5je_kEjIc7RCS1sgCkzZT2knkW8gZtFn958OnSuIUWo9mRV5azjYC274ArV3_kMAnYEIHDfiAvHuVu8wyGu2u8xoWKeZKLn68x9pZnsZ4A4YB0E55Ab0OTL7w%2C%2C&track=0,1,2
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
referrer-policy
no-referrer
server
openresty
alt-svc
clear
e1baa8309e20b8e8c8b7670d5f6ea902_3391.jpg
cdnativ.com/extban/242846220/creatives/23195684/ 		90 KB
91 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/242846220/creatives/23195684/e1baa8309e20b8e8c8b7670d5f6ea902_3391.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7b3237555aaf53e5c21d4136d911c06db8075e0156ddd73f4bcac266a1d98af

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6504
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655e7b0000c2e01316e000000001
last-modified
Thu, 10 Dec 2020 14:22:39 GMT
server
cloudflare
etag
W/"5fd22f2f-168c9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GTkPrd1pLdEUTuVjM6oRNdtP4OK%2F%2Ful47zeymt7BwT0OqsK7xCXkjsO%2FTurM1MeNor7DHoE2G%2F726%2Bi3BsIwwtKwKSMJYlWc2MheuZLHe5rCGB%2FvwLdYVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e772bd3c2e0-FRA
d8d3eff51f2a49b9abc9f62ad59dfd93_3127.jpg
cdnativ.com/extban/240842820/creatives/23185382/ 		54 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185382/d8d3eff51f2a49b9abc9f62ad59dfd93_3127.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afd3df19d65d71438c6202424dcfb3ba7cdc1202eed34bd570e03c0dfd67973a

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2342
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655e7b0000c2e0e53d0000000001
last-modified
Tue, 24 Nov 2020 13:19:54 GMT
server
cloudflare
etag
W/"5fbd087a-d75c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3%2BVowlN2%2FwH6r1Z9%2BnnH25uPFFnzcEGj3pQ1KbxrQzc7YsHOG%2F2ErnTxqqHKJBPM7%2FZSiesVLxMOxLLxQGm4%2Biat%2B5daQcAUxmygkJFBPi4crJpDKSMwXA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e772bd6c2e0-FRA
8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
cdnativ.com/extban/216329220/creatives/23055166/ 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055166/8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e90555d194210275fa33c03dc7f81580dd33eb3c2a6525f1da9fe3e97ee32fda

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6395
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655e7c0000c2e0ce2de000000001
last-modified
Mon, 08 Jun 2020 10:02:10 GMT
server
cloudflare
etag
W/"5ede0ca2-c3ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DltGz4Ve71mnxOJthnmBBgNviDydi791MlZ4uMl2e3kvKhMMnQ%2B%2BfYc46CapSvfgbYWFMnmTfdstTaomfqz27r%2Bj40DLdJRrMyXtxajvbaDvr0diFTD5Lw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e772bd8c2e0-FRA
6267528ddbd716c9059e0004f868d219_4767.jpg
cdnativ.com/extban/237524220/creatives/23169212/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/237524220/creatives/23169212/6267528ddbd716c9059e0004f868d219_4767.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56b018456eeffc491e2135e0cdba1990d94acc3dd144cd9076b9a110d01ab0f8

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2581
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655e800000c2e0cb95e000000001
last-modified
Fri, 30 Oct 2020 12:51:59 GMT
server
cloudflare
etag
W/"5f9c0c6f-8b8c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FoJHQolqypxIbadQkvqDkInCFgLfM6RPnykrP6FlD60lTve9eO%2F8WPo5WQXLRYQX5DcVwZcFN454nYrMTtKBMF6wnsZtHuLPfFbSow%2Bbu%2FuUud4oyl4JZg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e772bdac2e0-FRA
1b55976ecf1e58ae015b1f9cbdff0eb5_3784.jpg
cdnativ.com/extban/240808020/creatives/23185326/ 		32 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240808020/creatives/23185326/1b55976ecf1e58ae015b1f9cbdff0eb5_3784.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af86837f9fb3b0bc8a43e50fa854a9c528032630f7777fe9b024650488b4ac39

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3600
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655ebb0000c2e0b99a7000000001
last-modified
Tue, 24 Nov 2020 12:55:18 GMT
server
cloudflare
etag
W/"5fbd02b6-8132"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vrC5jJN%2FYmfOzbNtumQrLQ2WfwuW9N2nkHGaMdh7CFAA9EblXOooLovN5QVg2NzFOldscQJ%2FHUwUub37JczVSKyVfsp6yO%2FbxHHXXDRtbDXJ3TEYEWThxg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e779c94c2e0-FRA
1cd7712e9337d85c2a8d59556b57889a_6057.jpg
cdnativ.com/extban/237524220/creatives/23169142/ 		37 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/237524220/creatives/23169142/1cd7712e9337d85c2a8d59556b57889a_6057.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
347e72599c9ac78d0670b86f27cad88e97de822f4b596754529e4b2afbcb358c

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1536
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655ebb0000c2e0fd3fe000000001
last-modified
Fri, 30 Oct 2020 12:43:14 GMT
server
cloudflare
etag
W/"5f9c0a62-9465"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OxFxtQcWE%2BZOoVkvpc8CrDqub1TSEtpp5ZGmukne%2FDLcDLhAwbVRx0zKPSdnbSk3EWwfuEYhU5tKUG2LUYBMnGTBRMfdZq6WOcKx8bDpQcjt6Q8jCsLuJg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e779c95c2e0-FRA
e8e36f7d13e968c3796b4519ecb45431_8170.jpg
cdnativ.com/extban/237524220/creatives/23169196/ 		74 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/237524220/creatives/23169196/e8e36f7d13e968c3796b4519ecb45431_8170.jpg
Requested by
Host: www.sawfirst.com
URL: https://www.sawfirst.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93a95d0a4b9c2f493d0f2e2c76b3e1f91bf1fe31e9cfe619d39deb3eae6c8c99

Request headers

Referer
https://www.sawfirst.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5607
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655ebc0000c2e0dc955000000001
last-modified
Fri, 30 Oct 2020 12:48:45 GMT
server
cloudflare
etag
W/"5f9c0bad-12620"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aJw2FAaVZ98Q3tEZchbL3rq5%2BZFpHab1iOBwygJtQHqtaYP%2FfP12FtKiO3WjrLLgCwaf7xg%2FPKHC%2BUliKZiHlh9vxIcMSQgQuT8jmIP4FDZP1V4kB%2FUscw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e779c96c2e0-FRA
truncated
/ Frame 1510 		350 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3c41f4da5f7d6569364d3f152d18ab9875d24b8d65b88a51349722676fc96eed

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
9728faf5e1ee67b2138b0c8923878c15_6081.jpg
cdnativ.com/extban/240842820/creatives/23185374/ Frame 1510 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185374/9728faf5e1ee67b2138b0c8923878c15_6081.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85a798dbaf61d64cf6f6bf7d0ca57de472b5d15ffa3ed24bfaccaa66870ee5a5

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1030
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f190000c2e0be3dc000000001
last-modified
Tue, 24 Nov 2020 13:16:38 GMT
server
cloudflare
etag
W/"5fbd07b6-9b3a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oY4RgTfc9WqM1xvnt1%2BzFXCq3BAiMu9I20BZYwZQGyRFJMSrHxHfJoWX1WOK77hPuCyiBJZ9EGoSu5E3%2FbgVMD3X1s6QXq8NcxRoidAlgH2uN6ojllFTWw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dbac2e0-FRA
e1baa8309e20b8e8c8b7670d5f6ea902_3391.jpg
cdnativ.com/extban/242846220/creatives/23195684/ Frame 1510 		90 KB
91 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/242846220/creatives/23195684/e1baa8309e20b8e8c8b7670d5f6ea902_3391.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7b3237555aaf53e5c21d4136d911c06db8075e0156ddd73f4bcac266a1d98af

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6504
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f190000c2e0b99ae000000001
last-modified
Thu, 10 Dec 2020 14:22:39 GMT
server
cloudflare
etag
W/"5fd22f2f-168c9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=BhTIPjHITkDfxpRWYtlHmZmZzTgUanS%2FGR%2BW%2BMrj6La0ZC4ypGsJDN%2ByzgoKc8Ksdj4DA6EK5Eu%2FMMB278RNeZ4g6LMHBH9s7WTB79WH%2FPCqadPI%2BU3AMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dbcc2e0-FRA
d8d3eff51f2a49b9abc9f62ad59dfd93_3127.jpg
cdnativ.com/extban/240842820/creatives/23185382/ Frame 1510 		54 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185382/d8d3eff51f2a49b9abc9f62ad59dfd93_3127.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afd3df19d65d71438c6202424dcfb3ba7cdc1202eed34bd570e03c0dfd67973a

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2342
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f190000c2e0b8a96000000001
last-modified
Tue, 24 Nov 2020 13:19:54 GMT
server
cloudflare
etag
W/"5fbd087a-d75c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ggBHn1IIqLLN4zsxC8FB9e9QYF8DM4x6ilmHLp8%2B6uFxAyCT%2BZVSnpgWTqtieBDff5fEtU%2B0IvJ5SNLLaivGm37lYx1wTed6HK3NTmDF231h2A7HFsxqoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dbfc2e0-FRA
b12967d445bce336770b4d9d8029ab16_5060.jpg
cdnativ.com/extban/240842820/creatives/23185372/ Frame 1510 		44 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185372/b12967d445bce336770b4d9d8029ab16_5060.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e0ae61c5e4db1e6ed548f94681b517c9799258a4a1231b5d1d24f0809ca86b

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5049
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f1a0000c2e02c180000000001
last-modified
Tue, 24 Nov 2020 13:15:38 GMT
server
cloudflare
etag
W/"5fbd077a-b0ec"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qDZA%2FnVbKq%2BmbucByYMLLLBp%2FkhBwtdoUUSeTYKluQJDWEVMhHpsDNTVDaAS5R7W%2FCi1j0xsGLNVhK15%2FehVJAU%2BS%2FikrHUSJOQ4nKnfPc5noZxxrU1W%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dc1c2e0-FRA
8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
cdnativ.com/extban/216329220/creatives/23055166/ Frame 1510 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055166/8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e90555d194210275fa33c03dc7f81580dd33eb3c2a6525f1da9fe3e97ee32fda

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6395
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f1a0000c2e0f29a7000000001
last-modified
Mon, 08 Jun 2020 10:02:10 GMT
server
cloudflare
etag
W/"5ede0ca2-c3ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fR3SXBXsopv85LEy0gUm15FgkyTJ4c%2F9N1Hu60PyY5SzNbMIOCGYe57puTwgUN7RlsnZXEp4XTbN240sEZZt3y%2F9iduz1uJTNAvAwHWVmWYkOkMz5CWocg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dc2c2e0-FRA
4bc62f4818318c4787e228f0b5d789b9_2031.jpg
cdnativ.com/extban/240842820/creatives/23185376/ Frame 1510 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185376/4bc62f4818318c4787e228f0b5d789b9_2031.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7a270a78749419a52e1a6e3170d5eca54bf96be37ac87f1242cac51a197d8c7

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6226
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f1b0000c2e029964000000001
last-modified
Tue, 24 Nov 2020 13:17:45 GMT
server
cloudflare
etag
W/"5fbd07f9-e721"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bWSTjY0%2BEirNo%2BnaOlLab4tbOWAWuDO9texlQzYPfiX6nircSG9WfpD4dLZDnmHolyre0FMc2ZcAwUWNjZqzWc9dKUR0c8l7OsAMBLLQ3cWp7L7S1DJXlA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dc3c2e0-FRA
6267528ddbd716c9059e0004f868d219_4767.jpg
cdnativ.com/extban/237524220/creatives/23169212/ Frame 1510 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/237524220/creatives/23169212/6267528ddbd716c9059e0004f868d219_4767.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56b018456eeffc491e2135e0cdba1990d94acc3dd144cd9076b9a110d01ab0f8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2581
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f1b0000c2e0c91dd000000001
last-modified
Fri, 30 Oct 2020 12:51:59 GMT
server
cloudflare
etag
W/"5f9c0c6f-8b8c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WUg8eI1zqHwDx9%2FGz3yxJweMYXUUs0toOW6a9KLhDLeXwJbgWIvrXy5NaZJpvTY3NpTVyJ8FUFrYIwU4I6zwiYWWUq5pO%2BdVkDEtcDHCwQKLDr%2F%2Bx0%2FsMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dc4c2e0-FRA
146d09cbf42ede93bc58bb6a302384db_6629.jpeg
cdnativ.com/extban/216329220/creatives/23055168/ Frame 1510 		82 KB
83 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055168/146d09cbf42ede93bc58bb6a302384db_6629.jpeg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5121c6c9f15405ea739bfd8af98eb9e2939dfa827c474dac27426b430fd04ce8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6333
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f1b0000c2e01f9f0000000001
last-modified
Mon, 08 Jun 2020 10:02:51 GMT
server
cloudflare
etag
W/"5ede0ccb-1481e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3rnjqJCToEVkaPeHIAFDRWWcp0bWp8T47r4vVo6zomoxzsi2cJrywCqAzEL7StanYnjFlgm6SEKPZ1xmYlCdn3vEOhPN5oKHvgZaG3FHUEg8sxgtdyRRhA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e782dc5c2e0-FRA
i.php
discovernative.com/script/ Frame 1510 		0
40 B 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/i.php?stamat=m%7C%2C%2Cgie74iL-tGU3Bp_GH0dEdHP3xP.347%2CB_vB4K_OsEn617oVj2Gl4u7rVMy84Xl6AHZNcFm5eEIn8chxTe568V7iljQVXIpNSikNomKGLxv-IpTUZk8DLxmvv6lm-Vp5Sno6slrGgPFbSiGYzbln_Z50wH24zAnXyohyg26caxtatkfpYpmC2zMRnQIQaY2z7QJ8K70rXXyCpuNVbzpUOUnT2WNicMTXYdXML_NTXXQGPHfJ0U_INx_L23KqmXfQDrQ80h2OXtJhOWEIOYC8nsresuO7z6DqcuqHPYOoDerhcRb6mhyRJxXzAFnQDWqNfr7aVhlm7EMl2gyemV8QW_vSVuO08fx-G9jAMj0h3zgwmhV5QkDBIPLggLd_gkUW2TRJabkEgwjvTY0V0eWrQqYJjeBOqhsf93C89e8VNutrk-lldTR92XCM8bg3M7FwxaPdHR1ZpGc8eCbzNTuobPq_Iyqaswk5KLW6pZJdPARkiFwzB5yQ0gYiTGTwCnPgboTyqF1OK5Bt7aksP2ZOfYf6WCj8TqY1rLCCh_fzMwHkkvbvBMkbBk5dHCDFrdDh4ditBqUXn7CrjEVfVCmlf7mWXgvqDTgXO_OcAdKCrIn3lUHdYQhCGkqa7dgB7c5TWMPHiDPXtUv2tOiyjzpcGZRQ_GsZLi2RRwEKocDQl5QI-9Mh0FMY7yKvfqyS5qH5TSnJb50SRp26rLlSDbOyrt1Sd4ynWSmXRT4HPYv2ZHgXjO45wprXsP7O8HooMB5gYmfsXuLfUFIvYIEtCYAXRLcx4cLSch8zAE6FTEU-s3C4Cl1G4lSc0g%2C%2C&track=0,1,2,3,4,5,6,7
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
referrer-policy
no-referrer
server
openresty
alt-svc
clear
truncated
/ Frame 3259 		350 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3c41f4da5f7d6569364d3f152d18ab9875d24b8d65b88a51349722676fc96eed

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4bc62f4818318c4787e228f0b5d789b9_2031.jpg
cdnativ.com/extban/240842820/creatives/23185376/ Frame 3259 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185376/4bc62f4818318c4787e228f0b5d789b9_2031.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7a270a78749419a52e1a6e3170d5eca54bf96be37ac87f1242cac51a197d8c7

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6226
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f210000c2e029965000000001
last-modified
Tue, 24 Nov 2020 13:17:45 GMT
server
cloudflare
etag
W/"5fbd07f9-e721"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WOhYdWyUT%2BXNvSvje5Lm1DLMf4FVdwpRugy8iRHHWVc%2Fv0xzeTuyXim4Yv%2FeOhV7VKO5SVGO%2BtgK0msHissMjTTqRs%2BUc4I8W79ep0xIQeiZ0rShtsqPrg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e783deac2e0-FRA
8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
cdnativ.com/extban/216329220/creatives/23055166/ Frame 3259 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055166/8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e90555d194210275fa33c03dc7f81580dd33eb3c2a6525f1da9fe3e97ee32fda

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6395
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f210000c2e0f329d000000001
last-modified
Mon, 08 Jun 2020 10:02:10 GMT
server
cloudflare
etag
W/"5ede0ca2-c3ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vnIdtm%2BaPCXlcU735t41skSVVwkGdoMvOIjYaRk3Aquuvo3nI2JZcISgPVl8IHwa7ZCFX9fg3qR5f3J8oCndZ1uzyACuH6YZp14JPv3fO7C0U2Q8RxBaLw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e783debc2e0-FRA
9728faf5e1ee67b2138b0c8923878c15_6081.jpg
cdnativ.com/extban/240842820/creatives/23185374/ Frame 3259 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185374/9728faf5e1ee67b2138b0c8923878c15_6081.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85a798dbaf61d64cf6f6bf7d0ca57de472b5d15ffa3ed24bfaccaa66870ee5a5

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1030
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f220000c2e01f9f1000000001
last-modified
Tue, 24 Nov 2020 13:16:38 GMT
server
cloudflare
etag
W/"5fbd07b6-9b3a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VSWfb0GO0mnAKuppYLcCanZ3h7JOtWbJkyFNktUrn5LoDwAysE8ZXLJTSUoMTBOr652%2FDXsKG9tJNQVUCWSeRUY%2FcdksLldg5PqhYATdTDJC7gxJIG69ww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e783decc2e0-FRA
b12967d445bce336770b4d9d8029ab16_5060.jpg
cdnativ.com/extban/240842820/creatives/23185372/ Frame 3259 		44 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185372/b12967d445bce336770b4d9d8029ab16_5060.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e0ae61c5e4db1e6ed548f94681b517c9799258a4a1231b5d1d24f0809ca86b

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5049
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f220000c2e0180cc000000001
last-modified
Tue, 24 Nov 2020 13:15:38 GMT
server
cloudflare
etag
W/"5fbd077a-b0ec"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=K7Fww4UkpFJ6q1lg0Mg14ACx7geWrqFfrzD%2FUsJeFv2pn7FM2n8uCqzB%2Fyl%2FF3ulVxx9QP63bs%2BdV1XS8nBJ8xjJoCxpUNUMl0qRLUyTzo5LOvRQ%2FZN%2FAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e783deec2e0-FRA
i.php
discovernative.com/script/ Frame 3259 		0
40 B 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/i.php?stamat=m%7C%2C%2CQ3er4iLyoGU3BJ-GH0dEdHP3xP.7b2%2CMlfTaG6-RGAuyOFs1MkWMDWHZO3Zp1pVRAdzsFOms-_TKF5-8KQH-ZMZRtBAtqhVEMnYG319eI5NpW-HpMXPCyTNx4rDvt7I67ncdnbERfUX89vIWLrskF_rinTyZYMUxNX5EgEV_yig_R5t9_TVoA4Wzgg6BdCbxkrJb2bC1Me3lURlVjrxf0FwtCobBpd4JyQMv_flGb7isP5SoRBZ4q6oL8RuiFBeah-67Fv6eJdyy8DZDh65EFJs64K__EIaZEZgQ18E9B-0Z3bzIoWBKEZ4T99ieFnLh1t7CGE4If1M2Gq1s-7R0NTvAJuDFaOoC9aCx68zlYxHS8Vq6sro0PUex4pq7-sNZ0E47XX4e897X1j1IL_Yspcs09_9zt9Xohtm_wAHG0s7InPn_TaNHLN4mQjHOsA2op7oSz4hbVSj4QZdf_wHAsWxtmCq8vCgzinCY1z4xllZKawhlZapJFt57xWMA0LKF6809mG0vm6lSwwrG1fXTCq63NzZQRe1IdjazgZN-dqBlE8wIegJ86tF8nkdEl4BynQVXAHlTgEWuqfnWZAv0g-OKjTdaRRRki2J9LTY6xlBJ84mAoG6JgdnupkhCkras5vUztlKZclVFMmGrK03nu4M42-sPPTZbfC0uFLQWeItcAR1m6TlTw%2C%2C&track=0,1,2
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
referrer-policy
no-referrer
server
openresty
alt-svc
clear
truncated
/ Frame 66B6 		350 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3c41f4da5f7d6569364d3f152d18ab9875d24b8d65b88a51349722676fc96eed

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
9728faf5e1ee67b2138b0c8923878c15_6081.jpg
cdnativ.com/extban/240842820/creatives/23185374/ Frame 66B6 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185374/9728faf5e1ee67b2138b0c8923878c15_6081.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85a798dbaf61d64cf6f6bf7d0ca57de472b5d15ffa3ed24bfaccaa66870ee5a5

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1030
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f4c0000c2e00ebb7000000001
last-modified
Tue, 24 Nov 2020 13:16:38 GMT
server
cloudflare
etag
W/"5fbd07b6-9b3a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=U5d4Ax5668XFlMILEyNTem47E73S9kRb9ypeRGk85nxRmNJduhJeXyK%2FRVy%2Br4poTMLW4Es6J6oLv%2F1W2j1vX10mvZ6zBImiczXZGeOyeZpMMUhzMB2F3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e787ea5c2e0-FRA
8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
cdnativ.com/extban/216329220/creatives/23055166/ Frame 66B6 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055166/8d0f455e11d5726937cf117d3a0c9155_5642.jpeg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e90555d194210275fa33c03dc7f81580dd33eb3c2a6525f1da9fe3e97ee32fda

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6395
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f4e0000c2e0fd00c000000001
last-modified
Mon, 08 Jun 2020 10:02:10 GMT
server
cloudflare
etag
W/"5ede0ca2-c3ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EJd2h6FxczQIkM%2BCoA%2FPEKqMX5MxsqphUkc9T4%2B%2BDOi74DLsSbxhSf07NeFhGY2jhohsaaKNB0ZoUwnkhpouFukeDOu5w0b4oiBBUBMFvWMEWH8cy0mhvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e787eaec2e0-FRA
d8d3eff51f2a49b9abc9f62ad59dfd93_3127.jpg
cdnativ.com/extban/240842820/creatives/23185382/ Frame 66B6 		54 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185382/d8d3eff51f2a49b9abc9f62ad59dfd93_3127.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afd3df19d65d71438c6202424dcfb3ba7cdc1202eed34bd570e03c0dfd67973a

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2342
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f520000c2e0f78e0000000001
last-modified
Tue, 24 Nov 2020 13:19:54 GMT
server
cloudflare
etag
W/"5fbd087a-d75c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oeOuM4Y%2BlF5RPYYDZJgBL6PbbgzfZHpWPCXDLQJfb9zce7qRpuyDrs5XrQFutnRVrDdBHzhhkjAq%2Br%2B0U5FxDloIzkDk%2BX%2FxpqUo6EEnkQsxRH595eZqRg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e788ec0c2e0-FRA
1b55976ecf1e58ae015b1f9cbdff0eb5_3784.jpg
cdnativ.com/extban/240808020/creatives/23185326/ Frame 66B6 		32 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240808020/creatives/23185326/1b55976ecf1e58ae015b1f9cbdff0eb5_3784.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af86837f9fb3b0bc8a43e50fa854a9c528032630f7777fe9b024650488b4ac39

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3600
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f570000c2e0ce2f0000000001
last-modified
Tue, 24 Nov 2020 12:55:18 GMT
server
cloudflare
etag
W/"5fbd02b6-8132"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FEhqC0BXVjQydDSs%2FZi4XvNLnrs3iaiEbVno3anl2%2FNIBKga9dyjBLIZRTMrDeG%2BkG5g32BFU7g9H7JT01KqY3yPzMwvai9Si9X51EdvLqOuQegsLZlG6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e788ec4c2e0-FRA
146d09cbf42ede93bc58bb6a302384db_6629.jpeg
cdnativ.com/extban/216329220/creatives/23055168/ Frame 66B6 		82 KB
83 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/216329220/creatives/23055168/146d09cbf42ede93bc58bb6a302384db_6629.jpeg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5121c6c9f15405ea739bfd8af98eb9e2939dfa827c474dac27426b430fd04ce8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6333
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f4e0000c2e0c5900000000001
last-modified
Mon, 08 Jun 2020 10:02:51 GMT
server
cloudflare
etag
W/"5ede0ccb-1481e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HoVxbcVWvjzCPX493XMiXbfbU7mnrxFSUUKIAJSEe0tx1IY4B3SEoje0wssTk0raw75YpaCltZ7zgYwBKzk1z3Pkn2AjkjIauE77LC2XSP4WiOB2qlwpiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e787eb4c2e0-FRA
1cd7712e9337d85c2a8d59556b57889a_6057.jpg
cdnativ.com/extban/237524220/creatives/23169142/ Frame 66B6 		37 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/237524220/creatives/23169142/1cd7712e9337d85c2a8d59556b57889a_6057.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
347e72599c9ac78d0670b86f27cad88e97de822f4b596754529e4b2afbcb358c

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1536
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f520000c2e0c235b000000001
last-modified
Fri, 30 Oct 2020 12:43:14 GMT
server
cloudflare
etag
W/"5f9c0a62-9465"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=L00%2F2v2zY0y8nU8WqRd5uUUElUyEtksvWMsSE6pA5CyyQiubPnPz6TpvS8CDNSGkiLc6GjaQIxGM1EblphOoPCg3gcY1k4%2BKWsNwyqAypuhCyz6pK80lxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e788ec5c2e0-FRA
4bc62f4818318c4787e228f0b5d789b9_2031.jpg
cdnativ.com/extban/240842820/creatives/23185376/ Frame 66B6 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/240842820/creatives/23185376/4bc62f4818318c4787e228f0b5d789b9_2031.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7a270a78749419a52e1a6e3170d5eca54bf96be37ac87f1242cac51a197d8c7

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6226
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f520000c2e01082d000000001
last-modified
Tue, 24 Nov 2020 13:17:45 GMT
server
cloudflare
etag
W/"5fbd07f9-e721"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VdaWIh1pJj0IFOwYsZQvMaT1VREexUr%2FjWUl%2BT6JAXZjGxrLozZpMScU4qXoVtC%2BP3uTWe1JKLDWI4OYmM21trBa9jlLC72Paoda8wBmXz9Wo9QKu1uozw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e787eb7c2e0-FRA
e8e36f7d13e968c3796b4519ecb45431_8170.jpg
cdnativ.com/extban/237524220/creatives/23169196/ Frame 66B6 		74 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnativ.com/extban/237524220/creatives/23169196/e8e36f7d13e968c3796b4519ecb45431_8170.jpg
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:81e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93a95d0a4b9c2f493d0f2e2c76b3e1f91bf1fe31e9cfe619d39deb3eae6c8c99

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5607
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1d655f530000c2e0242cf000000001
last-modified
Fri, 30 Oct 2020 12:48:45 GMT
server
cloudflare
etag
W/"5f9c0bad-12620"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vziyf%2Fl2r5e42eZ9vbPv%2B2S4ehTh3JlxEjgmnQtFywle2Ut6m5YcDe6amEeGlRvfaMhbJBqwGh00YOjr8YzGiT5T9iK7JvVOGBV6m50DW1hVATICkPVx2A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
cf-ray
650f3e788ec8c2e0-FRA
i.php
discovernative.com/script/ Frame 66B6 		0
40 B 		Script
General
Check archive.org
Download Go to
Full URL
https://discovernative.com/script/i.php?stamat=m%7C%2C%2CAjfjIjFmtGU3Bk_GH0dEdHP3xP.009%2CvgfVsXvXu5NUUDRRhGEob7MmZVcfRyiH1ruL70SodOFzGvXeZbLW1WOEc5CuXBo5A7vS1LEDJYKVMB-cFtwW6oAUbqP6d957ZKgONSKIBO3Jt5Yp3ENISX3MRilx__kgiGbheIoveFuKGE10D0AQudFp8P3Z5ajwyEov2NH47H5UhZGI0qjbQXJ6rV2QhG29Qco7TkE5RRkXIQQM2hGx4zWdq_PE27omdA_p-cNSzOZIs67VJAGrmBhESSShLACCxeHMQGFzqCG3V0zBSup3hNRDZMnz83cz3-52j6YkRtDV_XBq0_ArYbwm1GZHTt2jSKh6_GeBPNm9LnlXsumNrt4kUErP_IYS0jZc73KIjhmdqt5wU7RnPr9r6MwjEZI2-CiBmZDxWhN3q686113RF76w8HUxvZbHyp6uBjn3ukugR5QEdhTim3s74TgkL6_WIhFK6NLH24v-OSjbIPRJZVasXKU-Dvuqdb4xAc0g4m1FS1pW7RXoUssEmfTCGwsVF5az_LZ8-sksCBmUh2XEiZx63T2_9ACSWJ5HASh8qa1naPtVCneA3ICmsJGPBnbgbIIuzaZyJE4v0AxIAwePLC6EAxCXV1iTBreMUgQ3Y3I--ITaCIurcYJJUNlapS7HY6ENy9C1D4R1jP0pHC4nI2mAICxXolyDs8Pvcx4xBaD8AI_1In6SSc45Yx5CQZPbwW0wKFo9nFLpQiv9sz7aTK3lmdoYsTkpq-eiLRzccKKCA2h1fkjTmZMvADlsk9r9-vsMDjjrm25ACDKVvlfcfSFhhbSjLtcdTymhW0A-_wI%2C&track=0,1,2,3,4,5,6,7
Requested by
Host: superonclick.com
URL: https://superonclick.com/script/style.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.31.231 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
231.31.211.130.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:35 GMT
via
1.1 google
referrer-policy
no-referrer
server
openresty
alt-svc
clear
i.php
www.onclickperformance.com/script/ Frame 8DC5 		0
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.onclickperformance.com/script/i.php?stamat=m%7C%2C%2CQhZ3o3M6oGU3BE9GH0dEdHP3xP.bee%2CI1C-NbQgNTQPX4yFdRd-XuG5SYC6-T055CQaPeEf3E5uxzCn-lRh7bCFd5fGjk8Oobl26hQ1dF2mtLjxWpH32sefJ31xDZXyALHJg1pzCXL2nkY2xKQ_cG7XFGOVYxP9ooR5rd6sbGd8R1wGxJAnKVygcbiY1W5VE_Pu2YwjR637n6V2nPz1xnKme8d4Rbw7MMdDoHO7dRElWY3jDfg9LqcatNfxpYjvDfKSC0PtumBC_t24RuOgoy6872dJO9KXaJtjcVuNGqfNos6seUKCVUmb0xG4RtBi_wOfmDRvs8bgzp2mnWKkEEM2oKRy1nAfch_EPCLZJlVDK0I0KQYS5UVm1IOppgxTQAfxM-g3MY0DcmxVxLu13bUtNJ0WW5fvod-6aQ5S6x5klM2lbxI6DSOza1yxSamfyB74a846L1Y%2C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.55.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.55.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2C8NiajY2JqB1dAN0dEdHP3xP.518%2CZMkKdRAQlkuDbgTABrav5A2p3doafuCDkjslrbo6QE-1x0i8I78m7lFPF8YQuUfeUt5_5ShnXnMtIAAHKDC7RnUBnmcimBPhm9YazYF4dDA%2C&cbrandom=0.7350881215455829&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:36 GMT
via
1.1 google
referrer-policy
no-referrer
server
openresty
alt-svc
clear
i.php
www.onclickperformance.com/script/ Frame 1D0B 		0
40 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.onclickperformance.com/script/i.php?stamat=m%7C%2C%2CQjMqdhfvoGU3BE9GH0dEdHP3xP.d82%2CPkQ50cRtmYXl_8qTV4H_m588HEafNQIxtc8p4hS45Qhv4PFoda3eyXzox1W_zHoXcND254mdbOuMxJa8TCi0hQIQSk0PeyHQ0ps1qdc0BL7YAFgGhBXcp8nerlE7IspgD-6O4qFolvX--23ghbQVTl_aJCOqIBLOO8cfV0uROYx2247PUa3wMlwRYM_2kdQjd93hDUaEo15Oqgnb9HXiW8a24u9XPh_z1g9ZSIVrv-6Hnjv74Y1dEvWlqDf3eB2JcnENmwMIE8dA2UwhtevxIad2dvekLZTTNsfUei9CFgt2XI58PBhVp7X3P7F8wKRazKDd-wo1fDzLlcTT0mZoe8HZY-YcIkbHATSFNAJQWG6mUV4l9lYvkxSifAdJphHdVGi32dp7dwajXst1X7-sWIaBrFMDFa0x3uNqLYmIwaM%2C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.55.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.55.190.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.onclickperformance.com/ad/display.php?stamat=m%7C%2CgtjO-YiIqB1dAN0dEdHP3xP.cea%2CZMkKdRAQlkuDbgTABrav5O7Q77TZamOMI-XCDUXdq4ae8JFo5gQ3FJJhSQqsgGgArZrep_ioVelvL4_p7DaOhnhMnlgLDR1XT6LV7auXo5E%2C&cbrandom=0.2765018932972929&cbtitle=SAWFIRST%20%7C%20Hot%20Celebrity%20Pictures&cbiframe=0&cbWidth=1600&cbHeight=1200&cbdescription=HQ%20Celebrity%20Pics%2C%20Hollywood%2C%20Pokies%2C%20Upskirt%2C%20Candids%2C%20Red%20Carpet%2C%20Photoshoot%2C%20Booty%2C%20Bikini...&cbkeywords=candids%2C%20celebrities%2C%20booty%2C%20bikini%2C%20pokies%2C%20celebrity%2C%20celebs%2C%20entertainment%2C%20gossip%2C%20hot%2C%20paparazzi%2C%20photos%2C%20photoshoot%2C%20photoshoots%2C%20pics%2C%20pictures%2C%20magazines%2C%20HQ&cbref=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 17 May 2021 19:27:36 GMT
via
1.1 google
referrer-policy
no-referrer
server
openresty
alt-svc
clear

Verdicts & Comments Add Verdict or Comment

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| gtag object| dataLayer object| zoneNativeSett object| urls function| acPrefetch object| nativeInit object| nativeForPublishers object| google_tag_manager object| google_js_reporting_queue number| google_srt object| google_ad_modifications object| google_logging_queue object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| adsbygoogle object| google_tag_data string| GoogleAnalyticsObject function| ga string| google_user_agent_client_hint object| gaplugins object| gaGlobal object| gaData object| _0x50db function| _0x48ba function| setupAd object| CTABPuNative object| _0x32b6 function| _0xda00 object| CTAHKA function| ufpAttach boolean| wait function| native_request function| inIframe function| checkDocumentBody function| documentAsyncWriteElementFromHtml function| ReopenUrlBuilder object| browser object| builder string| url string| content number| infolinks_pid number| infolinks_wsid undefined| $ function| jQuery object| ct_tribes_objectL10n object| $iceboot object| INFOLINKS object| wp function| _typeof object| $ice object| $infolinks string| zone object| adcashUfp function| hb_iceChunk object| hb_ice object| _pbjsGlobals object| $ICE_HB function| NativeAd object| core object| nativeWatermarkModal

23 Cookies

Domain/Path Name / Value
.casalemedia.com/ Name: CMRUM3
Value: bc60a2c3a605a00&4060a2c3a72760no-consent&2760a2c3a60b40&e660a2c3a62760&2d60a2c3a72760CAESEOmwWzAdEPWikr4JQIm_nSs&bf60a2c3a605a0&f160a2c3a605a0&2f60a2c3a72760ofi4F6yi1LIITR5
.casalemedia.com/ Name: CMID
Value: YKLDpnDkyCfN7Fs1arCLtAAA
.infolinks.com/ Name: PUBMUSERCOOKIE
Value: C9730A17-BB7F-4B16-9079-BCCCF0A4D4F9
.ufpcdn.com/ Name: __cf_bm
Value: 6bb876a1198398f1e1ef336a38b2688e03ab476a-1621279654-1800-AWNhj1NEtov5qtB2gw0CYwbthrIZYfuJDLKkWHG1mbNzKEL6OwVkqoSWuTZPU03zza9YTK5FDxdDdZQ/KsVCUHw=
.infolinks.com/ Name: ZMNUSERCOOKIE
Value: ""
.casalemedia.com/ Name: CMPRO
Value: 1180
pt.potawe.com/ Name: psui
Value: a8895b35c18b602478a21ff801b34b42
.infolinks.com/ Name: ZTUSERCOOKIE
Value: 1875819619876477546
.casalemedia.com/ Name: CMST
Value: YKLDpmCiw6cA
.infolinks.com/ Name: OUTHUSERCOOKIE
Value: y-YE6TRwRE2uEp281Js4SUP8LT8G3SxkqO~A~UPee9d88d1-b745-11eb-a180-0221adc671b4
.infolinks.com/ Name: VRUSERCOOKIE
Value: y-MPoWERdE2uErF0CYrntgErahaFQvLpA6ebR0Mb4-~A
.sawfirst.com/ Name: _gat_gtag_UA_39697070_1
Value: 1
.infolinks.com/ Name: ANUSERCOOKIE
Value: 5680856009878954723
.casalemedia.com/ Name: CMPS
Value: 3164
.infolinks.com/ Name: IXUSERCOOKIE
Value: YKLDpnDkyCfN7Fs1arCLtAAA&1180
.infolinks.com/ Name: SOVRNUSERCOOKIE
Value: aaff1fbdd30bcda3cd76a78f
.infolinks.com/ Name: R1USERCOOKIE
Value: OPTOUT
www.sawfirst.com/ Name: adcashufpv3
Value: 16087852919722895121740344843
www.sawfirst.com/ Name: logglytrackingsession
Value: 9e8959af-676d-4044-95a0-444b0612c5f6
.sawfirst.com/ Name: _ga
Value: GA1.2.1366263518.1621279654
.doubleclick.net/ Name: IDE
Value: AHWqTUk8Z4RJqk_8vKB5j21Wfhp8dgMrG_Fe4zaoIXgSSX8eYeJv1Z-yxxCcgXkPYYA
.sawfirst.com/ Name: _gid
Value: GA1.2.338329801.1621279654
www.sawfirst.com/ Name: ls_smartpush
Value: 1

4 Console Messages

Source Level URL
Text
console-api log URL: https://www.sawfirst.com/wp-content/litespeed/cssjs/8eaba.js?55079(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 3.3.2
console-api log URL: https://resources.infolinks.com/js/1747.002-3.012/ice.js(Line 1)
Message:
[object Object]
console-api log URL: https://resources.infolinks.com/js/1747.002-3.012/ice.js(Line 1)
Message:
Failed to log to loggly because of this exception: SecurityError: Blocked a frame with origin "https://www.sawfirst.com" from accessing a cross-origin frame.
console-api log URL: https://resources.infolinks.com/js/1747.002-3.012/ice.js(Line 1)
Message:
Failed log data: [object Object]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ap.lijit.com
b1sync.zemanta.com
cdnativ.com
cm.g.doubleclick.net
crrepo.com
de.tynt.com
discovernative.com
dmp.brand-display.com
dsp.adkernel.com
dsum-sec.casalemedia.com
galleryn2.awemdia.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
image4.pubmatic.com
image8.pubmatic.com
match.adsrvr.org
match.bnmla.com
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
pixel-sync.sitescout.com
pixel.advertising.com
pm.w55c.net
pt-static3.ptwmstc.com
pt-static4.ptwmstc.com
pt-static5.ptwmstc.com
pt.potawe.com
resources.infolinks.com
router.infolinks.com
rtb.adentifi.com
s.amazon-adsystem.com
s.cpx.to
ssc-cms.33across.com
ssum-sec.casalemedia.com
superonclick.com
sync.1rx.io
sync.go.sonobi.com
ufpcdn.com
ups.analytics.yahoo.com
www.google-analytics.com
www.googletagmanager.com
www.onclickperformance.com
www.sawfirst.com
104.22.3.144
130.211.31.231
142.250.74.194
174.137.133.49
178.162.133.149
185.64.190.79
185.64.190.80
185.64.190.81
193.0.160.128
2.18.234.21
208.100.17.183
213.19.147.44
216.52.2.30
2606:4700:3034::ac43:81e7
2606:4700:3037::6815:293c
2606:4700:3037::ac43:8e31
2606:4700:3038::6815:eb72
2a00:1450:4001:808::2008
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::200e
2a00:1450:4001:811::2008
2a00:1450:4001:813::2002
2a00:1450:4001:828::200e
3.125.99.7
3.126.56.137
34.251.124.7
35.190.55.95
35.241.40.233
37.252.173.38
38.27.122.126
51.89.9.252
52.202.1.196
52.28.254.214
66.155.71.25
66.206.12.119
67.202.110.23
70.42.32.95
72.21.206.140
76.223.111.131
93.93.51.190
93.93.51.191
93.93.51.200
07e8d6ea069f651d48ad47731cce6d24417176b3a353554f40fe2d5f8b81afb1
087461f044d6f216bc883207c3a7d00c91a5c7288733938649a26edc324509e8
0d9b5032fb29eb6183213ab6e54ce3bfe2ba4d289e33abfd0fe5cca8e61d9b1e
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d
176b5ee76d22d0a81ca09ada4e629177160e7ebbf72c2f25c64da4bcf5e37128
194098486a9bf0977a009766b5c8859531892768f34f1a6bca4797d31636a5f0
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2f7e329f3c48194be076086ff2df5b3472c345a893106021cbe7f3e2ab30c069
33fe875776c050561a122e39735246893419dbd61fd78d5991be4c82625c038f
347e72599c9ac78d0670b86f27cad88e97de822f4b596754529e4b2afbcb358c
35a3d91d677d31038cdcf5a5d786172617b786157ed7385d53b629e94ac9fc92
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3c41f4da5f7d6569364d3f152d18ab9875d24b8d65b88a51349722676fc96eed
407de28da1c39b7d37b5bded8b97297069fc9a7b3f93a0cef6ec9381f1283917
5121c6c9f15405ea739bfd8af98eb9e2939dfa827c474dac27426b430fd04ce8
535785a82be044cdbf0542695ec14e3a36a0381a7f5a050e920bc49d4aaf1ec6
53e60faa688b7a75e27878f5575b3bf4ff068c2ffc7a0094eac3546e31e87ffe
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56b018456eeffc491e2135e0cdba1990d94acc3dd144cd9076b9a110d01ab0f8
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
60975a642a438f8cf3a1d5c565f6e7cba96143bb2ebf1c1d6efeb9cb11f08c16
6932f2e4acbedd39e9c46b1e3f85d8e8b0666d5d99d5940fb4fd8da935f5c09c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
73904e3a3d5061153f12915315b32ebb7f12051019bac2abe7de1988b86d9338
7965b4334f08b3c398843d721ab3b5535461f4183ec6bb0923d1ae092b9cfd51
7afd54d578b74f9a2cb539a8fbab691e79a4348badae7fe0de26674fa2a97469
7b06a655db7277250b3fccf043fcf65f0710c93c4466699c88319187229ce24a
7f0644e1001c127a6b328acc18e9c4ea666f406d355cc78b167a251c64953857
84e0ae61c5e4db1e6ed548f94681b517c9799258a4a1231b5d1d24f0809ca86b
85a798dbaf61d64cf6f6bf7d0ca57de472b5d15ffa3ed24bfaccaa66870ee5a5
8bdb5b7c1e4af7700a29d6d9ad7506834fcfad11d4c221ba11fcaf1d7959598b
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
93a95d0a4b9c2f493d0f2e2c76b3e1f91bf1fe31e9cfe619d39deb3eae6c8c99
9cb61c345f9815344443e8bb9c29b86008c151dcb024837062cd14dbc77b81ca
a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a
a5dd6c5de9e86796602a60c031ffe3dd6e7b66bc0129bff6054baedc9f4c3080
ad8f73120d2a8f6bbb7f98704692e7cd28c153838abcd31a64aa5f98ee5b4e59
aef6b1a90384cb7b24f4698b86ef2aa72a511a2f9cafa6e6ae3f695c147b4541
af86837f9fb3b0bc8a43e50fa854a9c528032630f7777fe9b024650488b4ac39
afd3df19d65d71438c6202424dcfb3ba7cdc1202eed34bd570e03c0dfd67973a
b0e675d8fcaec6e54624c3421ce55ca293bdd7757eb936708c778cbe4465cf0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6807257488f55924ec855d8a87b495fc87a552eb30cf395c0953e932f921199
b6c6cc7aa6d693762b0e5ee84740b0a4d2cf765de77fc4e9f6f212a7207d360e
b7b3237555aaf53e5c21d4136d911c06db8075e0156ddd73f4bcac266a1d98af
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c29bf01b2caef00c02b7f73d58fb2eec46ce862a5b174111343a3147d56f4446
c7b5d3864935f0dcfc7e5e91685cd48b80af3ff58b224a51f621d27eb04dfd0b
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d7f100a4a7ee1fb04b29965c4624c6f455bf69926cbe0a22d89f763cf412cc49
deb5719528aa2668cab2f8a72b98cf225529d2fb2ab9f49a4f02481d6b204619
e170d20dbbd5a22f50118e25fa2eefb1e85d2ad780e5477ed3a9643186090442
e282545f9f7c4117db91f8a2c33e5a1dad31f3c6edbe74b9776c1f8b85c166bd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6e0a6e1b2ea0ed56461a196a51c1cc33b81369d91de9e4a4123d7a47a2b1969
e7a270a78749419a52e1a6e3170d5eca54bf96be37ac87f1242cac51a197d8c7
e90555d194210275fa33c03dc7f81580dd33eb3c2a6525f1da9fe3e97ee32fda
e97a9988dce8067f81f57557b349dd481e0335e75175179b6b01322be2ff13a5
e9cd0faddcec01f98997264ee0265690499d4f7adede1fe651719c0a3d4d044b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef22755bc9501f967f1cb92530ea9a24c98432e12dfa2b35a71482b3e5579b21
fe33d94f16ddc49eae38e103925f71767c405175987cefa4eb771300fff9d7f2
fea721b7d25d7646e10655fdc461a3a98adf0598cd9e0ef273b08dd7f6cedf7b
ffa811ff2834d53f32832c8b70d7df7208264e144629487bbd91179ca13a5eca
ffb16355784a4a89472be6cb28c3408234ec0518326a3a1908797b8d8c78a76a