forums.babypips.com Open in urlscan Pro
34.224.142.149 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Submission: On December 14 via manual (December 14th 2022, 3:33:59 am UTC) from AU — Scanned from AU

Summary HTTP 294 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 69 IPs in 6 countries across 58 domains to perform 294 HTTP transactions. The main IP is 34.224.142.149, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is forums.babypips.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on October 26th 2022. Valid for: a year.

This is the only time forums.babypips.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	34.224.142.149 34.224.142.149	14618 (AMAZON-AES) (AMAZON-AES)
2 54	13.35.8.23 13.35.8.23	16509 (AMAZON-02) (AMAZON-02)
7	104.18.3.3 104.18.3.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	74.125.200.138 74.125.200.138	15169 (GOOGLE) (GOOGLE)
2	13.33.88.57 13.33.88.57	16509 (AMAZON-02) (AMAZON-02)
1	104.16.221.29 104.16.221.29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.155.68.111 18.155.68.111	16509 (AMAZON-02) (AMAZON-02)
2 8	65.9.164.14 65.9.164.14	16509 (AMAZON-02) (AMAZON-02)
3	157.240.235.1 157.240.235.1	32934 (FACEBOOK) (FACEBOOK)
1	104.18.26.85 104.18.26.85	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	142.251.12.157 142.251.12.157	15169 (GOOGLE) (GOOGLE)
1	198.145.13.13 198.145.13.13	2044 (DF-PTL1) (DF-PTL1)
1	54.192.150.40 54.192.150.40	16509 (AMAZON-02) (AMAZON-02)
7	142.250.4.154 142.250.4.154	15169 (GOOGLE) (GOOGLE)
1	13.33.88.44 13.33.88.44	16509 (AMAZON-02) (AMAZON-02)
14 17	18.136.172.50 18.136.172.50	16509 (AMAZON-02) (AMAZON-02)
2	104.17.120.107 104.17.120.107	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	157.240.235.35 157.240.235.35	32934 (FACEBOOK) (FACEBOOK)
1	52.49.107.217 52.49.107.217	16509 (AMAZON-02) (AMAZON-02)
3 4	35.213.12.39 35.213.12.39	15169 (GOOGLE) (GOOGLE)
10 13	172.253.118.154 172.253.118.154	15169 (GOOGLE) (GOOGLE)
2 8	139.5.84.243 139.5.84.243	27381 (CASALE-MEDIA) (CASALE-MEDIA)
2 3	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
2 2	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
1 1	34.98.67.3 34.98.67.3	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7 11	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
1 7	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	66.225.223.159 66.225.223.159	3949 (NTTA-3946) (NTTA-3946)
1 2	67.199.150.86 67.199.150.86	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
3 4	52.74.162.2 52.74.162.2	16509 (AMAZON-02) (AMAZON-02)
1	141.226.229.48 141.226.229.48	200478 (TABOOLA-AS) (TABOOLA-AS)
2 3	35.71.178.8 35.71.178.8	16509 (AMAZON-02) (AMAZON-02)
2 7	104.254.150.228 104.254.150.228	29990 (ASN-APPNEX) (ASN-APPNEX)
2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 2	209.191.163.209 209.191.163.209	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
3	69.173.158.65 69.173.158.65	26667 (RUBICONPR...) (RUBICONPROJECT)
11	145.40.89.200 145.40.89.200	54825 (PACKET) (PACKET)
1	172.64.154.237 172.64.154.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.172.34.118 35.172.34.118	14618 (AMAZON-AES) (AMAZON-AES)
1	142.250.4.156 142.250.4.156	15169 (GOOGLE) (GOOGLE)
1	142.250.4.157 142.250.4.157	15169 (GOOGLE) (GOOGLE)
2	74.125.24.132 74.125.24.132	15169 (GOOGLE) (GOOGLE)
16	142.250.4.132 142.250.4.132	15169 (GOOGLE) (GOOGLE)
4	142.250.4.105 142.250.4.105	15169 (GOOGLE) (GOOGLE)
3	172.217.194.157 172.217.194.157	15169 (GOOGLE) (GOOGLE)
17	172.217.194.155 172.217.194.155	15169 (GOOGLE) (GOOGLE)
30	142.250.4.148 142.250.4.148	15169 (GOOGLE) (GOOGLE)
1	157.240.15.14 157.240.15.14	32934 (FACEBOOK) (FACEBOOK)
1	142.250.4.155 142.250.4.155	15169 (GOOGLE) (GOOGLE)
27	104.16.13.64 104.16.13.64	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	74.125.68.95 74.125.68.95	15169 (GOOGLE) (GOOGLE)
1	151.101.64.208 151.101.64.208	54113 (FASTLY) (FASTLY)
2	184.31.5.52 184.31.5.52	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.18.36.94 104.18.36.94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.65.108 151.101.65.108	54113 (FASTLY) (FASTLY)
1	52.21.197.24 52.21.197.24	14618 (AMAZON-AES) (AMAZON-AES)
1 1	50.116.239.135 50.116.239.135	6336 (TURN-US-ASN) (TURN-US-ASN)
4 4	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1 1	202.241.208.54 202.241.208.54	4694 (IDCF IDC ...) (IDCF IDC Frontier Inc.)
2 2	13.33.88.32 13.33.88.32	16509 (AMAZON-02) (AMAZON-02)
1	104.19.158.19 104.19.158.19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	104.18.33.19 104.18.33.19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.217.194.94 172.217.194.94	15169 (GOOGLE) (GOOGLE)
1	172.67.154.71 172.67.154.71	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 3	35.227.202.26 35.227.202.26	15169 (GOOGLE) (GOOGLE)
2 2	107.178.244.193 107.178.244.193	() ()
1 1	65.9.164.71 65.9.164.71	() ()
1	37.157.2.237 37.157.2.237	() ()
1 1	23.106.127.39 23.106.127.39	59253 (LEASEWEB-...) (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd.)
2 2	103.231.98.197 103.231.98.197	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	67.199.150.85 67.199.150.85	() ()
1	54.194.182.31 54.194.182.31	() ()
1	103.231.98.203 103.231.98.203	() ()
1	18.184.243.181 18.184.243.181	() ()
1	54.175.249.242 54.175.249.242	() ()
1	54.95.68.35 54.95.68.35	() ()
3 5	52.46.130.91 52.46.130.91	() ()
1 1	103.229.10.192 103.229.10.192	16509 (AMAZON-02) (AMAZON-02)
1 2	52.77.191.91 52.77.191.91	() ()
2 2	18.138.91.242 18.138.91.242	() ()
1 1	35.247.47.28 35.247.47.28	() ()
2 3	52.95.126.160 52.95.126.160	() ()
1	13.107.42.14 13.107.42.14	() ()
294	69

5 34.224.142.149 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-142-149.compute-1.amazonaws.com

forums.babypips.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.bpcdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

54 13.35.8.23 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-35-8-23.sin5.r.cloudfront.net

f.bpcdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.18.3.3 (None, )

ASN13335 (CLOUDFLARENET, US)

cookie-cdn.cookiepro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.200.138 (United States)

ASN15169 (GOOGLE, US)
PTR: sa-in-f138.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.33.88.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-88-57.sin2.r.cloudfront.net

a.babypips.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.221.29 (None, )

ASN13335 (CLOUDFLARENET, US)

static.getclicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.155.68.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-155-68-111.sin52.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 65.9.164.14 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-65-9-164-14.bkk50.r.cloudfront.net

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.235.1 (Singapore, Singapore)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-04-sin6.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.26.85 (None, )

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 142.251.12.157 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f157.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.145.13.13 (United States)

ASN2044 (DF-PTL1, US)
PTR: getclicky.com

in.getclicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.150.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-150-40.sin2.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.4.154 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f154.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.88.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-88-44.sin2.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 18.136.172.50 (Singapore, Singapore) 14 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-136-172-50.ap-southeast-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.120.107 (None, )

ASN13335 (CLOUDFLARENET, US)

biddr.brealtime.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.235.35 (Singapore, Singapore)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-04-sin6.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.107.217 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-107-217.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.213.12.39 (Tokyo, Japan) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 39.12.213.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 172.253.118.154 (United States) 10 redirects

ASN15169 (GOOGLE, US)
PTR: sl-in-f154.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 139.5.84.243 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.254.65 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.3 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.67.98.34.bc.googleusercontent.com

tags.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 69.173.158.64 (Singapore, Singapore) 7 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.98.64.218 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jp-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.225.223.159 (Sacramento, United States)

ASN3949 (NTTA-3946, US)
PTR: sa.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.199.150.86 (Los Angeles, United States) 1 redirects

ASN3257 (GTT-BACKBONE GTT, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.74.162.2 (Singapore, Singapore) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-74-162-2.ap-southeast-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.229.48 (Singapore)

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.71.178.8 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ade9ecc7904667038.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.254.150.228 (Los Angeles, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

okodigital-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jp-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.191.163.209 (United States) 1 redirects

ASN32475 (SINGLEHOP-LLC, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 69.173.158.65 (Ashburn, United States)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 145.40.89.200 (Ashburn, United States)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.154.237 (United States)

ASN13335 (CLOUDFLARENET, US)

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.172.34.118 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-34-118.compute-1.amazonaws.com

e1.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.4.156 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f156.1e100.net

adservice.google.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.4.157 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f157.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.24.132 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f132.1e100.net

2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 142.250.4.132 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.4.105 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f105.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.194.157 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f157.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 172.217.194.155 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f155.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 142.250.4.148 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f148.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.15.14 (Singapore, Singapore)

ASN32934 (FACEBOOK, US)
PTR: edge-atlas-shv-03-sin6.facebook.com

ad.atdmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.4.155 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f155.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 104.16.13.64 (None, )

ASN13335 (CLOUDFLARENET, US)

c.bannerflow.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.68.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sc-in-f95.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.64.208 (United States)

ASN54113 (FASTLY, US)

media.fxcm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.31.5.52 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-5-52.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.36.94 (None, )

ASN13335 (CLOUDFLARENET, US)

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.108 (United States)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.21.197.24 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-197-24.compute-1.amazonaws.com

emxhb.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.116.239.135 (United States) 1 redirects

ASN6336 (TURN-US-ASN, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.33.220.150 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 202.241.208.54 (Japan) 1 redirects

ASN4694 (IDCF IDC Frontier Inc., JP)

tg.socdm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.33.88.32 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-33-88-32.sin2.r.cloudfront.net

cr-p3.ladsp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.158.19 (None, )

ASN13335 (CLOUDFLARENET, US)

assets.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.33.19 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.194.94 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.154.71 (United States)

ASN13335 (CLOUDFLARENET, US)

id.a-mx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.227.202.26 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 26.202.227.35.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.244.193 (None, ) 2 redirects

ASN- ()

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.164.71 (None, ) 1 redirects

ASN- ()

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.2.237 (None, )

ASN- ()

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.106.127.39 (Singapore, Singapore) 1 redirects

ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG)

ssbsync-global.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.231.98.197 (Japan) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image8.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.150.85 (None, ) 1 redirects

ASN- ()

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.194.182.31 (None, )

ASN- ()

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.231.98.203 (None, )

ASN- ()

ow.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.243.181 (None, )

ASN- ()

pb-server.ezoic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.175.249.242 (None, )

ASN- ()

pbs.nextmillmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.95.68.35 (None, )

ASN- ()

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.46.130.91 (None, ) 3 redirects

ASN- ()

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.229.10.192 (Singapore) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.77.191.91 (None, ) 1 redirects

ASN- ()

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.138.91.242 (None, ) 2 redirects

ASN- ()

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.247.47.28 (None, ) 1 redirects

ASN- ()

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.95.126.160 (None, ) 2 redirects

ASN- ()

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (None, )

ASN- ()

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	bpcdn.co 2 redirects f.bpcdn.co a.bpcdn.co	975 KB
35	googlesyndication.com 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 139 pagead2.googlesyndication.com — Cisco Umbrella Rank: 103	267 KB
32	doubleclick.net 10 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 193 stats.g.doubleclick.net — Cisco Umbrella Rank: 81 cm.g.doubleclick.net — Cisco Umbrella Rank: 215 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 297	229 KB
30	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 269	182 KB
27	bannerflow.net c.bannerflow.net — Cisco Umbrella Rank: 10281	279 KB
25	adroll.com 16 redirects s.adroll.com — Cisco Umbrella Rank: 2503 d.adroll.com — Cisco Umbrella Rank: 1464	36 KB
17	rubiconproject.com 7 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 321 fastlane.rubiconproject.com — Cisco Umbrella Rank: 451 eus.rubiconproject.com — Cisco Umbrella Rank: 547 prebid-server.rubiconproject.com token.rubiconproject.com	20 KB
12	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 858 assets.a-mo.net — Cisco Umbrella Rank: 3088	7 KB
12	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 507 htlb.casalemedia.com — Cisco Umbrella Rank: 478 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 413 ssum.casalemedia.com — Cisco Umbrella Rank: 1328	10 KB
9	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 395 okodigital-d.openx.net — Cisco Umbrella Rank: 108757 jp-u.openx.net — Cisco Umbrella Rank: 9869	2 KB
8	amazon-adsystem.com 5 redirects s.amazon-adsystem.com aax-eu.amazon-adsystem.com	6 KB
8	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 218 acdn.adnxs.com — Cisco Umbrella Rank: 579	24 KB
7	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 192	327 KB
7	cookiepro.com cookie-cdn.cookiepro.com — Cisco Umbrella Rank: 6819	127 KB
6	yahoo.com 4 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 287 pr-bh.ybp.yahoo.com	3 KB
6	pubmatic.com 4 redirects image2.pubmatic.com — Cisco Umbrella Rank: 882 image8.pubmatic.com — Cisco Umbrella Rank: 597 image4.pubmatic.com ow.pubmatic.com	2 KB
5	google.com adservice.google.com — Cisco Umbrella Rank: 72 www.google.com — Cisco Umbrella Rank: 2	2 KB
5	babypips.com forums.babypips.com a.babypips.com — Cisco Umbrella Rank: 860453	33 KB
4	adsrvr.org 4 redirects match.adsrvr.org — Cisco Umbrella Rank: 323	2 KB
4	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 290	2 KB
4	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 652 script.hotjar.com — Cisco Umbrella Rank: 797 vars.hotjar.com — Cisco Umbrella Rank: 929 in.hotjar.com — Cisco Umbrella Rank: 1744	73 KB
3	mookie1.com 3 redirects odr.mookie1.com — Cisco Umbrella Rank: 951	806 B
3	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 350	1 KB
3	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 335	567 B
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 152	119 KB
2	w55c.net 2 redirects pm.w55c.net	1 KB
2	tapad.com 2 redirects pixel.tapad.com	785 B
2	ladsp.com 2 redirects cr-p3.ladsp.com — Cisco Umbrella Rank: 24864	1 KB
2	indexww.com js-sec.indexww.com — Cisco Umbrella Rank: 605 cdn.indexww.com — Cisco Umbrella Rank: 1503	2 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 311 fonts.googleapis.com — Cisco Umbrella Rank: 37	34 KB
2	emxdgt.com e1.emxdgt.com — Cisco Umbrella Rank: 770 emxhb.emxdgt.com — Cisco Umbrella Rank: 95796	214 B
2	lijit.com 1 redirects ap.lijit.com — Cisco Umbrella Rank: 604	1 KB
2	pippio.com 2 redirects pippio.com — Cisco Umbrella Rank: 696	718 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	203 B
2	brealtime.com biddr.brealtime.com — Cisco Umbrella Rank: 4361	90 KB
2	getclicky.com static.getclicky.com — Cisco Umbrella Rank: 11873 in.getclicky.com — Cisco Umbrella Rank: 9785	6 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 28	20 KB
1	linkedin.com px.ads.linkedin.com	596 B
1	simpli.fi 1 redirects um.simpli.fi	623 B
1	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 644	512 B
1	nextmillmedia.com pbs.nextmillmedia.com	455 B
1	ezoic.com pb-server.ezoic.com	456 B
1	servenobid.com ads.servenobid.com	357 B
1	smartadserver.com 1 redirects ssbsync-global.smartadserver.com — Cisco Umbrella Rank: 1867	352 B
1	adform.net cm.adform.net	106 B
1	agkn.com 1 redirects aa.agkn.com	671 B
1	a-mx.com id.a-mx.com — Cisco Umbrella Rank: 3185	515 B
1	gstatic.com fonts.gstatic.com	44 KB
1	socdm.com 1 redirects tg.socdm.com — Cisco Umbrella Rank: 917	852 B
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 743	441 B
1	fxcm.com media.fxcm.com	564 B
1	atdmt.com ad.atdmt.com — Cisco Umbrella Rank: 3929
1	google.com.au adservice.google.com.au — Cisco Umbrella Rank: 78998	792 B
1	taboola.com sync.taboola.com — Cisco Umbrella Rank: 972	223 B
1	outbrain.com sync.outbrain.com — Cisco Umbrella Rank: 737	308 B
1	linksynergy.com 1 redirects tags.rd.linksynergy.com — Cisco Umbrella Rank: 3997	392 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 678	308 B
0	iqzone.com Failed cs.iqzone.com Failed
294	58

	Domain	Requested by
54	f.bpcdn.co	2 redirects forums.babypips.com f.bpcdn.co
30	s0.2mdn.net	securepubads.g.doubleclick.net forums.babypips.com s0.2mdn.net
27	c.bannerflow.net	2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com c.bannerflow.net s0.2mdn.net forums.babypips.com
17	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com forums.babypips.com
17	d.adroll.com	14 redirects s.adroll.com forums.babypips.com
16	tpc.googlesyndication.com	securepubads.g.doubleclick.net forums.babypips.com 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com tpc.googlesyndication.com
15	securepubads.g.doubleclick.net	f.bpcdn.co securepubads.g.doubleclick.net forums.babypips.com www.googletagservices.com 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com
13	cm.g.doubleclick.net	10 redirects jp-u.openx.net forums.babypips.com
11	prebid.a-mo.net	biddr.brealtime.com forums.babypips.com
8	dsum-sec.casalemedia.com	2 redirects forums.babypips.com ssum-sec.casalemedia.com
8	s.adroll.com	2 redirects f.bpcdn.co forums.babypips.com s.adroll.com d.adroll.com
7	www.googletagservices.com	securepubads.g.doubleclick.net 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com
7	ib.adnxs.com	2 redirects forums.babypips.com biddr.brealtime.com acdn.adnxs.com
7	pixel.rubiconproject.com	3 redirects forums.babypips.com
7	cookie-cdn.cookiepro.com	forums.babypips.com cookie-cdn.cookiepro.com
5	s.amazon-adsystem.com	3 redirects ssum-sec.casalemedia.com
5	us-u.openx.net	1 redirects forums.babypips.com jp-u.openx.net
4	token.rubiconproject.com	4 redirects
4	match.adsrvr.org	4 redirects
4	www.google.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	ups.analytics.yahoo.com	3 redirects forums.babypips.com
4	x.bidswitch.net	3 redirects forums.babypips.com
3	aax-eu.amazon-adsystem.com	2 redirects
3	odr.mookie1.com	3 redirects
3	jp-u.openx.net	biddr.brealtime.com jp-u.openx.net
3	googleads4.g.doubleclick.net	forums.babypips.com
3	fastlane.rubiconproject.com	biddr.brealtime.com
3	eb2.3lift.com	2 redirects forums.babypips.com
3	idsync.rlcdn.com	2 redirects forums.babypips.com
3	connect.facebook.net	f.bpcdn.co connect.facebook.net
3	forums.babypips.com	forums.babypips.com f.bpcdn.co
2	pm.w55c.net	2 redirects
2	pr-bh.ybp.yahoo.com	1 redirects ssum-sec.casalemedia.com
2	image8.pubmatic.com	2 redirects
2	pixel.tapad.com	2 redirects
2	ssum-sec.casalemedia.com	js-sec.indexww.com ssum-sec.casalemedia.com
2	cr-p3.ladsp.com	2 redirects
2	eus.rubiconproject.com	biddr.brealtime.com eus.rubiconproject.com
2	2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	ap.lijit.com	1 redirects biddr.brealtime.com
2	image2.pubmatic.com	1 redirects forums.babypips.com
2	pippio.com	2 redirects
2	www.facebook.com	forums.babypips.com
2	biddr.brealtime.com	f.bpcdn.co biddr.brealtime.com
2	a.bpcdn.co	f.bpcdn.co a.bpcdn.co
2	a.babypips.com	f.bpcdn.co a.babypips.com
2	www.google-analytics.com	f.bpcdn.co www.google-analytics.com
1	px.ads.linkedin.com	forums.babypips.com
1	cdn.indexww.com	ssum-sec.casalemedia.com
1	um.simpli.fi	1 redirects
1	cms.quantserve.com	1 redirects
1	prebid-server.rubiconproject.com	forums.babypips.com
1	pbs.nextmillmedia.com	forums.babypips.com
1	pb-server.ezoic.com	forums.babypips.com
1	ow.pubmatic.com	forums.babypips.com
1	ads.servenobid.com	forums.babypips.com
1	ssum.casalemedia.com	1 redirects
1	image4.pubmatic.com	1 redirects
1	ssbsync-global.smartadserver.com	1 redirects
1	cm.adform.net	forums.babypips.com
1	aa.agkn.com	1 redirects
1	id.a-mx.com	forums.babypips.com
1	fonts.gstatic.com	fonts.googleapis.com
1	assets.a-mo.net	prebid.a-mo.net
1	tg.socdm.com	1 redirects
1	ad.turn.com	1 redirects
1	emxhb.emxdgt.com	biddr.brealtime.com
1	acdn.adnxs.com	biddr.brealtime.com
1	js-sec.indexww.com	biddr.brealtime.com
1	fonts.googleapis.com	s0.2mdn.net
1	media.fxcm.com	s0.2mdn.net
1	ajax.googleapis.com	s0.2mdn.net
1	ad.atdmt.com	forums.babypips.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.com.au	securepubads.g.doubleclick.net
1	e1.emxdgt.com	biddr.brealtime.com
1	htlb.casalemedia.com	biddr.brealtime.com
1	okodigital-d.openx.net	biddr.brealtime.com
1	sync.taboola.com	forums.babypips.com
1	sync.outbrain.com	forums.babypips.com
1	tags.rd.linksynergy.com	1 redirects
1	in.hotjar.com	script.hotjar.com
1	vars.hotjar.com	static.hotjar.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	script.hotjar.com	static.hotjar.com
1	in.getclicky.com	static.getclicky.com
1	geolocation.onetrust.com	cookie-cdn.cookiepro.com
1	static.hotjar.com	f.bpcdn.co
1	static.getclicky.com	f.bpcdn.co
0	cs.iqzone.com Failed
294	90

This site contains links to these domains. Also see Links.

Domain
www.babypips.com
marketmilk.babypips.com
www.thisismoney.co.uk
cookiepedia.co.uk
www.cookiepro.com

Subject Issuer	Validity	Valid
babypips.com Amazon RSA 2048 M02	`2022-10-26` - `2023-11-24`	a year	crt.sh
bpcdn.co Amazon RSA 2048 M01	`2022-10-26` - `2023-11-24`	a year	crt.sh
cookiepro.com Cloudflare Inc ECC CA-3	`2022-04-19` - `2023-04-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-04` - `2023-06-03`	a year	crt.sh
*.hotjar.com Amazon	`2022-10-25` - `2023-11-23`	a year	crt.sh
s.adroll.com Amazon	`2022-07-03` - `2023-08-01`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-09-22` - `2022-12-21`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.getclicky.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-01` - `2023-09-01`	a year	crt.sh
d.adroll.com Amazon RSA 2048 M02	`2022-11-08` - `2023-12-07`	a year	crt.sh
*.brealtime.com Go Daddy Secure Certificate Authority - G2	`2022-01-21` - `2023-02-22`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2022-06-27` - `2023-06-05`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.a-mo.net R3	`2022-12-04` - `2023-03-04`	3 months	crt.sh
*.emxdgt.com Amazon	`2022-06-03` - `2023-07-02`	a year	crt.sh
*.google.com.au GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.atlassolutions.com DigiCert SHA2 High Assurance Server CA	`2022-09-22` - `2022-12-21`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.fxcm.com R3	`2022-11-27` - `2023-02-25`	3 months	crt.sh
cdn.adnxs.com GeoTrust TLS RSA CA G1	`2022-03-11` - `2023-04-11`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2022-05-18` - `2023-06-16`	a year	crt.sh
ads.servenobid.com Amazon	`2022-05-29` - `2023-06-27`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-14`	a year	crt.sh
*.ezoic.com Amazon	`2022-08-30` - `2023-09-28`	a year	crt.sh
pbs.nextmillmedia.com Amazon	`2022-07-13` - `2023-08-11`	a year	crt.sh

This page contains 30 frames:

Primary Page: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Frame ID: 17A37DF4EAB8775AD031782114F6C6CD
Requests: 120 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-5e66f98b4ee957db209dc6f63e3d59dd.html
Frame ID: 0D22F08E21343528B6A407B658C3EF96
Requests: 1 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.js?nnn=1670988826880
Frame ID: 6B0E9640DB47717D95C92435FF87B2F1
Requests: 2 HTTP requests in this frame

Frame: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: A09D5234B7A8B4EA82DD60F52CC1B2F2
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuVemkUY0QIy0kwl7vvUlSfk81vfkczLwn_qhBYbtlgVSTNbEoK4mu_16r-BRUgEKVt67dw-OD0VWwKGoN6vl3DVfs31cyQ0vqUfmuX_fEg9bA-mDkWLoJq7LTVY_fFjmljClGP7Q449uqRN-mYQ1NGSAXOYibO-kMKpGQ1Z5rVRX-hjZafPDqdcDaVryjkbjHVgaQSKAZQUk-GK5ZEKqXZcUxAhciQbNf5o5iPel45cNQvSURzMT1YxdnDxFj-hjTA5sGwl8zuqfnovaJI3YLfXbcgRrSBFNxbj_mfC2nZDKLYe9zTQ7HLjX0tzXbvSRWfxsS0qjlDZBw&sai=AMfl-YQmOlDmIrpk7gvs2t4AN45D1R3QlWkUjaV09qxqMYIlt8KxYOiAxDVUg-aFVgjbR_tQBTRFlLB0wEkCVcxm4BtjuwZXQ_Ye3B4heIBA8dk9EGCYkML75mXs0kh5NvP2&sig=Cg0ArKJSzPyh4stY22LdEAE&uach_m=[UACH]&adurl=
Frame ID: C47590AB5BDB204FBA99D4ACA92F6A0B
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss0iZWsIoiFjvUPkYMR_mHgqOwCQpvB_8wjqNrIPBjUIWDbgKLRoM0vxHzSF5Yu6oB_7r1V8REpOssqBdGNzds4q8lhbOtRLTx5dXKDLY17aCKpFDZfCLRDcLBkbQ5mHCVIv-hBLVZxXgoZbgBfpIzmrqpyloKAVu_UghaRb0tRU7tADm725FaiwFyXaPAzejQVOli29z6yKFuU1gmusjaOzHl5iwj1xnnQUMEC9NIafqjI346JScmNgnj51mXRgIfIBEqdj3jgCvXjsn45Pm9ODrSL3_MCYV5YgxUDTLW9ece3sCS-XTtjvJ2F3pJxSKsDiu50rhdNdxo&sai=AMfl-YTChsm1UtjkJ47EkMCbuM0YO5A9AHSuvN_lGTw4Dyk3WaYfaKq53dtGnSeJonA86cBDU5p4JehoKNUxqV5KDkrPbGrZZi7nX2RMyl63xMhYyR3mebbdrmaY2j-47ADl&sig=Cg0ArKJSzM0I8P9TJ8eHEAE&uach_m=[UACH]&adurl=
Frame ID: 8691A49510027ADCEA1689827CF7535F
Requests: 8 HTTP requests in this frame

Frame: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: E89E0670FEFB97BA6D33D2A8301B8527
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss_Ddxmyl9puXPUFnTnKi6qp_RKH5sdiayHcQp0M2Ovw6XyyHwJCvbUSnxwB7Yw8CJU4QIfwQDMbqVU9nj32cxVfrS0SVgdb-WRw4-DVQb5JPx-WEBfnUNDcv80V2Rvhw3QC8WF1dnAalRviBwxEJs2ACpgwwpwLFx2Zx1HChOo4XINIgMCdDYdex5xRGCAdBnaQ5QO5M9bLK8HTE1lNBxoCrNpp0f5BY0IC_iUS_P-8_NvZ9uChtkRLWf3M7wycRH2hkw7a2Y5aRjV3-cWQ68WvGloO9dpwCCHIhzORVWyaaLpNAZX3MF4IkLE6OJJCaU&sai=AMfl-YSASMWFYUDTxKpba1E-oLFN3WI7RKyF5wRROXuLFrQILtjnFkgWF8Wd3K2kxceXUtGjiMmqQLNOVEk4DLAB9-NfmR_3ghrIWOGasyrp0BuFKxbP70zisF7e-ZFj5MWX&sig=Cg0ArKJSzDZ88gk0OdEiEAE&uach_m=[UACH]&adurl=
Frame ID: 8AD8EE8D7D8351F0C8A3567748C82570
Requests: 8 HTTP requests in this frame

Frame: https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv6bhAvw4R14_bgW9YZnGSmrrFfihN14ZZcT0nxTbXLUOkiuRMayCvcc4MHgU67RkspfHKb4_LC593JhrtnKV__SjUcY5R2RvAuOGHUHKNzaUw2sp_4FpvvTsH1Q2Gq44y-2DldDqoGneRGmGB9sogNZnH5t5awvrffZjk32pZr1uWF0U_P_ch3Uyv8KRigCD2QGRsdbU3BhCVmQrbhpduFjzqay1DsEpZ_ML5yemAyLijzKiA3iaxrs-ISGEb7fqrSMr5oDBWXUAFCessYoaALjvvCnVZFUY58hwXlNK77L-sFhj-IN-TCx8Qg6qyLUewKAJ0T7-0IyMa6dJVPNXQkUq1yTirh9LjjJ3qWwL8LTYhtMg5I6oM2A040ThIpySyVamZ6yiSjQbTHr-xpLdsprJVF10oeE2g&sai=AMfl-YQDC8JHk7d9gKoz1pwSqWHX1tgBISNyH0YmjdsUVZI9fbf_we9Z5gEh4tXnfmsljUSBilPpWY3Z_cymyFuM_9YwC8KgadhNEZISefPHcq8WIQEl95xcR82v9aDxrJcU&sig=Cg0ArKJSzDzp1QjG8VAiEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Frame ID: A40A88C86A856A4453FA008CEA8B7471
Requests: 9 HTTP requests in this frame

Frame: https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsubJ_zGkI9efAUkZJhf31ZZqvZyY2hSJFUcLsiwc9aOsvAQ752KrTWT444N_Ty_wgo-8yWkAToBwtBHqpu9in9nYH7T4ADrS1vAngAnaZ-1iDaiDJni_EsAd_BjzUFALWIGtftGRgj1s2kvQkapXGdEJAj9zrr8MCjiu43F9taAQ-NZqeXb2GDX2oSY50ZtdFkDqhD-28kX0CHozoIQzMLConGj92hatXkQ8YIBi17l59_pDaft8mQqSjPrqyNhwNbLmcXvhycdJ3PslVktZJT4dd-YjEUzVIuobIGL_BNExRnYPbL7t6rrGjAwkCIjUCzPAHOS0gofvIN3CQfC3S1Qc6KqgsY5tGIvTqtq5LDpSdurECPpCwJ3sYCsty1DmmpNw15c9Vxosz5khUw91kbKS6Kc5PIaGrJ7w0MGKGY&sai=AMfl-YQrH9Veo9erk870x4Km9e9AXfM2mTKZkt-w0yE_nwlWi3lADYANxMrdTJDJHYSX0ZGUcu8uyxNdn2EtCkc5EzuEfWpYucTWKa_ChZISnK9EP_4xiXy-sS-gu2MH_0GB&sig=Cg0ArKJSzL3rYgg8wDo_EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Frame ID: 026CE24D8077DF5C07796CECB39F9282
Requests: 7 HTTP requests in this frame

Frame: https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvFgctDNHnlFqKG9Z9L-4Yha8poY-UbtGckoWWNRPIkNUSyIQOS-8zDLx3lO_XP5N5NfTzeFXHDMtY0DU9IHpDk-gMJN9rcLSvD7gcMWQkSAGhH8zwKfUrODIo2uGUQWu_nR-8RMEjgY2YhzbeEV9zKUHPD77C739Bk2tI3R41mJq5W8bTwSyciZ040nq79jzXfvsgpoo6ocoPEvOzAVLBK6SVbkZTb2NofYRH8srBvp2GwSz9P_2SAnTpq5kHDAUzhuT8S64PvT8ya02_h7R6nsn9AuMPWDZyBpkFN4mjQL7NFqsPbccJKDpJ2Dj1eBYg3EvlgSl-T25TzZU4Pqmrbyz-GFbgZYia-oReDQhKKZ-56WBj6kKKDUpR0ETHv-gau0tE9ycftAcPDdF7fq1gAGtqWaaM9kgeuG1GZizLExpiqU_w&sai=AMfl-YT-Y6mEKgG3X6Aqc5QcuBFWBrA3fr3B-4HBkz2oTR3hXIIn_7Zjss_Qua-IdXvzoVwElCESsi0EBsHRV5T4gvHRHhg-VSs_eh0hoLtWQIOn9qhCfgqRV7yOVK8Q7ali&sig=Cg0ArKJSzK71ShPsMXO0EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Frame ID: 666B684CB00518DABF1385FBBFFA1F31
Requests: 7 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
Frame ID: E73C146DDAE477B544700CAB7CD79ED6
Requests: 29 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C348E8D39B8D4BC28EC4E778EF1A5240
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 41BF36E19909D66F1A2C1808B8388998
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4769B869BE844562E85ED32950096CE4
Requests: 3 HTTP requests in this frame

Frame: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Frame ID: BC0FAB5C16FF971E257ABB08D3487527
Requests: 8 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1832608659671089152/AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html
Frame ID: 654AF34CA2EFDE7C1DBF744AEADCEA9B
Requests: 11 HTTP requests in this frame

Frame: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0
Frame ID: 3C478C272409DB6077216573CC3B165D
Requests: 7 HTTP requests in this frame

Frame: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---
Frame ID: C8EA5D30639AC980C6A9221B4843EA75
Requests: 20 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: C5A756D110787331E7D4590212C0229E
Requests: 10 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: C2E8AD3B22FD43EE04B0CDCB01F5F3AD
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 61DE7206676C8D4F0D9FED06005329F1
Requests: 3 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: 3F915A0703326B79BCCB385389042B58
Requests: 10 HTTP requests in this frame

Frame: blob://https://s0.2mdn.net/817e747d-3687-4210-afb6-40360685bbd6
Frame ID: 3C98BE663E4E96CC872ADFEC67DBDFD7
Requests: 1 HTTP requests in this frame

Frame: blob://https://c.bannerflow.net/8f9ac877-55ba-4f51-9054-084c8da0165f
Frame ID: 4F01F05B59F802B1250058C5096A2601
Requests: 1 HTTP requests in this frame

Frame: https://c.bannerflow.net/accounts/activtrades/5bc9a648f4ea2773b0608f61/images/a15f940a-efd8-40cf-acb6-d8073e48dc46.svg
Frame ID: F015FEBA54773C7C8DC5E05B52FE64B1
Requests: 2 HTTP requests in this frame

Frame: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Ffxcm%2F624ff6c94e4d7ee019f2b626%2Fimages%2F775f79bc-2321-4519-a419-b33272d71e85.jpg&w=728&h=90&q=99&f=webp&rt=contain
Frame ID: 4A871CF1BA7C70DD1507F4274CEE59A8
Requests: 5 HTTP requests in this frame

Frame: https://c.bannerflow.net/misc/libs/gsap/3.5.1/gsap.min.js
Frame ID: A77DCA95A60621889AB28F210C50C296
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E24E1208936369EBF20DAE7E0D7DF985
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 28B052AB2DCC046793158D437369E569
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Curtis Fox forex scammer - Commercial Content / Scam Stories - BabyPips.com ForumBack ButtonSearch IconFilter Icon

Detected technologies

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Clicky (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.getclicky\.com

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

294
Requests

83 %
HTTPS

0 %
IPv6

58
Domains

90
Subdomains

69
IPs

6
Countries

2897 kB
Transfer

10774 kB
Size

80
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: https://www.babypips.com/
Title: BabyPips

Search URL Search Domain Scan URL

URL: https://www.babypips.com/news
Title: News

Search URL Search Domain Scan URL

URL: https://www.babypips.com/trading
Title: Trading

Search URL Search Domain Scan URL

URL: https://www.babypips.com/learn
Title: Learn Forex

Search URL Search Domain Scan URL

URL: https://www.babypips.com/crypto
Title: Learn Crypto

Search URL Search Domain Scan URL

URL: https://www.babypips.com/economic-calendar
Title: Calendar

Search URL Search Domain Scan URL

URL: https://www.babypips.com/tools
Title: Tools

Search URL Search Domain Scan URL

URL: https://marketmilk.babypips.com/
Title: MarketMilk™

Search URL Search Domain Scan URL

URL: https://marketmilk.babypips.com/currency-strength
Title: Currency Strength Meter

Search URL Search Domain Scan URL

URL: https://marketmilk.babypips.com/currency-volatility
Title: Currency Volatility

Search URL Search Domain Scan URL

URL: https://marketmilk.babypips.com/market-movers
Title: Top Gainers and Losers

Search URL Search Domain Scan URL

URL: https://marketmilk.babypips.com/crypto
Title: Crypto Market Snapshot

Search URL Search Domain Scan URL

URL: https://marketmilk.babypips.com/crypto/currency-strength
Title: Crypto Strength Meter

Search URL Search Domain Scan URL

URL: https://www.babypips.com/trading/trade-ideas
Title: Trade Ideas

Search URL Search Domain Scan URL

URL: https://www.babypips.com/trading/technical-analysis
Title: Technical Analysis

Search URL Search Domain Scan URL

URL: https://www.babypips.com/trading/psychology
Title: Psychology

Search URL Search Domain Scan URL

URL: https://www.babypips.com/trading/trading-systems
Title: Trading Systems

Search URL Search Domain Scan URL

URL: https://www.babypips.com/learn/forex
Title: How to Trade Forex

Search URL Search Domain Scan URL

URL: https://www.babypips.com/forexpedia
Title: Forex Glossary

Search URL Search Domain Scan URL

URL: https://www.babypips.com/quizzes
Title: Trading Quizzes

Search URL Search Domain Scan URL

URL: https://www.babypips.com/crypto/learn
Title: Crypto School

Search URL Search Domain Scan URL

URL: https://www.babypips.com/crypto/glossary
Title: Crypto Glossary

Search URL Search Domain Scan URL

URL: https://www.babypips.com/crypto/quizzes
Title: Crypto Quizzes

Search URL Search Domain Scan URL

URL: https://www.babypips.com/tools/forex-market-hours
Title: Forex Market Hours

Search URL Search Domain Scan URL

URL: https://www.babypips.com/tools/pivot-point-calculator
Title: Pivot Point Calculator

Search URL Search Domain Scan URL

URL: https://www.babypips.com/tools/position-size-calculator
Title: Position Size Calculator

Search URL Search Domain Scan URL

URL: https://www.babypips.com/tools/gain-loss-percentage-calculator
Title: Gain / Loss % Calculator

Search URL Search Domain Scan URL

URL: https://www.babypips.com/tools/pip-value-calculator
Title: Pip Value Calculator

Search URL Search Domain Scan URL

URL: https://www.babypips.com/tools/forex-regulation
Title: Regulatory Organizations

Search URL Search Domain Scan URL

URL: https://www.thisismoney.co.uk/money/beatthescammers/article-8522169/Beware-bedroom-traders-boasting-fortunes-currency-bets.html
Title: https://www.thisismoney.co.uk/money/beatthescammers/article-8522169/Beware-bedroom-traders-boasting-fortunes-currency-bets.html

Search URL Search Domain Scan URL

URL: https://www.babypips.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.babypips.com/risk-disclosure
Title: Risk Disclosure

Search URL Search Domain Scan URL

URL: https://www.babypips.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.cookiepro.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

https://f.bpcdn.co/user_avatar/forums.babypips.com/ria_rose/32/182332_2.png HTTP 301
https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_32x32.jpeg

Request Chain 52

https://f.bpcdn.co/user_avatar/forums.babypips.com/ria_rose/45/182332_2.png HTTP 301
https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_45x45.jpeg

Request Chain 72

https://s.adroll.com/j/exp/WKE6MKSUNNB7PHMNEK4DGH/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 73

https://s.adroll.com/j/pre/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

Request Chain 85

https://d.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&cookie=&adroll_s_ref=&keyw= HTTP 302
https://s.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/AGSJGGLE2VH5BN4ZL4GWYO.js

Request Chain 91

https://d.adroll.com/cm/b/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI

Request Chain 92

https://d.adroll.com/cm/g/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w&google_tc= HTTP 302
https://d.adroll.com/cm/g/in

Request Chain 93

https://d.adroll.com/cm/index/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expiration=1702524827 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expiration=1702524827&C=1

Request Chain 94

https://d.adroll.com/cm/l/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://idsync.rlcdn.com/377928.gif?partner_uid=b92ddb082f0564889915d9789bf0a6db HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CMiIFxIrCicIARDqIhogYjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGIQABoNCJuI5ZwGEgUI6AcQAEIASgA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=8a747742a949c78d9f39221347d112a85c52e30f9a1389a1f797cfb7b7811ac1791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA4YTc0Nzc0MmE5NDljNzhkOWYzOTIyMTM0N2QxMTJhODVjNTJlMzBmOWExMzg5YTFmNzk3Y2ZiN2I3ODExYWMxNzkxNDI2YjU0MTdkY2UyMRAAGgwInIjlnAYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4YTc0Nzc0MmE5NDljNzhkOWYzOTIyMTM0N2QxMTJhODVjNTJlMzBmOWExMzg5YTFmNzk3Y2ZiN2I3ODExYWMxNzkxNDI2YjU0MTdkY2UyMRAAGgwInIjlnAYSBAgCEABCAEoA&google_gid=CAESEJbo5rsZRxzIZTGN2ZXfEC4&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=66534dcf-f24e-42f6-b3ab-5b2558d1ebbb

Request Chain 95

https://d.adroll.com/cm/n/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expires=365

Request Chain 96

https://d.adroll.com/cm/o/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=b92ddb082f0564889915d9789bf0a6db&gdpr=0&gdpr_consent= HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=b92ddb082f0564889915d9789bf0a6db&gdpr=0&gdpr_consent=

Request Chain 97

https://d.adroll.com/cm/outbrain/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=

Request Chain 98

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 99

https://d.adroll.com/cm/r/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

Request Chain 100

https://d.adroll.com/cm/taboola/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI

Request Chain 101

https://d.adroll.com/cm/triplelift/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://eb2.3lift.com/xuid?mid=4714&xuid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&dongle=c85e HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=

Request Chain 102

https://d.adroll.com/cm/x/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH HTTP 302
https://ib.adnxs.com/setuid?entity=172&code=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DYjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI

Request Chain 103

https://d.adroll.com/cm/g/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&advertisable=WKE6MKSUNNB7PHMNEK4DGH&google_nid=adroll4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w&google_tc= HTTP 302
https://d.adroll.com/cm/g/in

Request Chain 210

https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3482314458098331222&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 211

https://match.adsrvr.org/track/cmf/openx?oxid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=b7f60573-cd25-41e5-ab27-6cc400f93aa2&ttd_puid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0&gdpr_consent=

Request Chain 212

https://tg.socdm.com/rtb/sync_before?proto=openx HTTP 302
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y5lEIMCo5sIAAKqBOtQAAAAA

Request Chain 213

https://cr-p3.ladsp.com/cookiesender/3 HTTP 302
https://cr-p3.ladsp.com/cookiesender/3?cr=true HTTP 302
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ac-cltWeTccwks8ADzHoqlvnzs8AAAGFDrIeIQ

Request Chain 215

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIYaptL_Bo3qOtP6__CkV-s&google_cver=1

Request Chain 240

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=b1a94680-3654-4715-a4aa-96c923ace3b1&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=3f68ea01-d876-4123-83b2-3f55ccbc4e1c&ssp=adaptmx&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10524208644498154506&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26ssp%3Dadaptmx%26gdpr_consent%3D%26gdpr%3D0 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10524208644498154506&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26ssp%3Dadaptmx%26gdpr_consent%3D%26gdpr%3D0 HTTP 302
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=fe0d3161-da90-4172-803f-57828f3bca4d&ssp=adaptmx&gdpr_consent=&gdpr=0 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10524208644498154506&ssp=adaptmx&gdpr=0&gdpr_consent= HTTP 302
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=208840804365001485731&ssp=adaptmx&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=419&user_id=10524208644498154506&ssp=adaptmx&gdpr=0&gdpr_consent= HTTP 302
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=3f68ea01-d876-4123-83b2-3f55ccbc4e1c&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 241

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=b1a94680-3654-4715-a4aa-96c923ace3b1 HTTP 302
https://prebid.a-mo.net/setuid/yahoo?uid=y-smYkWalE2uG6yjH546ztJ5HbFrjcFuOZNaCjtzI-~A&gdpr=0&gdpr_consent=

Request Chain 242

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://prebid.a-mo.net/setuid/magnite?uid=LBN3LRH4-13-48JM&gdpr=0

Request Chain 244

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dtriplelift%26uid%3D%24UID&gdpr=0&gdpr_consent= HTTP 302
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=triplelift&uid=3540352548715518921418

Request Chain 245

https://ssp.disqus.com/redirectuser?partner=adaptmx&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dzeta%26uid%3D%24UID HTTP 302
https://ce.lijit.com/merge?pid=279534&3pid=ua-85dd1b12-965a-30f4-a48c-4ba8554cd840&gdpr=0&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNID%5D%26r%3DCid1YS04NWRkMWIxMi05NjVhLTMwZjQtYTQ4Yy00YmE4NTU0Y2Q4NDAqfWh0dHBzOi8vcHJlYmlkLmEtbW8ubmV0L3NldHVpZD9BPWIxYTk0NjgwLTM2NTQtNDcxNS1hNGFhLTk2YzkyM2FjZTNiMSZiaWRkZXI9emV0YSZ1aWQ9dWEtODVkZDFiMTItOTY1YS0zMGY0LWE0OGMtNGJhODU1NGNkODQwMgIMGjgB HTTP 302
https://ssp.disqus.com/match?bidder=12&buyeruid=F0AVDBZH_Nvn_DNUQuu3_Ouz&r=Cid1YS04NWRkMWIxMi05NjVhLTMwZjQtYTQ4Yy00YmE4NTU0Y2Q4NDAqfWh0dHBzOi8vcHJlYmlkLmEtbW8ubmV0L3NldHVpZD9BPWIxYTk0NjgwLTM2NTQtNDcxNS1hNGFhLTk2YzkyM2FjZTNiMSZiaWRkZXI9emV0YSZ1aWQ9dWEtODVkZDFiMTItOTY1YS0zMGY0LWE0OGMtNGJhODU1NGNkODQwMgIMGjgB HTTP 302
https://cs.iqzone.com/a6da5bf591376177b08e1eb90117169d.gif?puid=[UID]&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS04NWRkMWIxMi05NjVhLTMwZjQtYTQ4Yy00YmE4NTU0Y2Q4NDAqfWh0dHBzOi8vcHJlYmlkLmEtbW8ubmV0L3NldHVpZD9BPWIxYTk0NjgwLTM2NTQtNDcxNS1hNGFhLTk2YzkyM2FjZTNiMSZiaWRkZXI9emV0YSZ1aWQ9dWEtODVkZDFiMTItOTY1YS0zMGY0LWE0OGMtNGJhODU1NGNkODQwMgIMGjgC

Request Chain 246

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dsmartadserver%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=smartadserver&uid=1745824891060393275

Request Chain 247

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253Db1a94680-3654-4715-a4aa-96c923ace3b1%2526bidder%253Dpubmatic%2526uid%253D%2523PMUID HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjFBMkNBRTgtRTc5Ni00MzczLUI3NjctNUQ1ODIwMTk4NkY0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dpubmatic%26uid%3D61A2CAE8-E796-4373-B767-5D58201986F4 HTTP 302
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=pubmatic&uid=61A2CAE8-E796-4373-B767-5D58201986F4

Request Chain 248

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=index_rtb&uid=Y5lEHF2L62h5fnEzuPphwAAA%264682

Request Chain 249

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=sovrn&uid=F0AVDBZH_Nvn_DNUQuu3_Ouz

Request Chain 250

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dappnexus%26uid%3D%24UID HTTP 302
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=appnexus&uid=1414100499887693088

Request Chain 257

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Y5lEHF2L62h5fnEzuPphwAAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEN0lJz9La5nKE4_sRcpyL1E&google_cver=1

Request Chain 258

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=b7f60573-cd25-41e5-ab27-6cc400f93aa2&expiration=1673580832&gdpr=0&gdpr_consent=

Request Chain 259

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEI47EHzM22ROZm9mwKywiyI&google_cver=1

Request Chain 260

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&dcc=t

Request Chain 261

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=o5Lr0KGV4Nm4mODZo5H_2vCY4Iq4l-XQrMfSgP7L

Request Chain 262

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://pr-bh.ybp.yahoo.com/sync/casale/Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB

Request Chain 263

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=UTQSEmCf1P5iwM5

Request Chain 264

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=7A47499C0C56449AA4D3186D176538A0

Request Chain 266

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id= HTTP 302
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=O9FcZOBkQXyKvTtPpZKwNA&rk=usync-other HTTP 302
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=O9FcZOBkQXyKvTtPpZKwNA

Request Chain 267

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELySJTlwPw_xb3wO6APTcrA&google_cver=1

Request Chain 268

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBN3LRH4-13-48JM

Request Chain 269

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJOM0xSSDQtMTMtNDhKTQ==

Request Chain 270

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=b7f60573-cd25-41e5-ab27-6cc400f93aa2&gdpr=0&gdpr_consent=&expires=30

Request Chain 271

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDcwN2IyZjg0ZDRiYjAyZmY5NWMyOTVjYTdlMWNlZmI1Njk3MWIzOQ

Request Chain 272

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/rKaHnsECVpbyB_hFu8j_lMn5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-VszGFEZE2oKkvj4OgcK3WxuF5aqbtVQa_ocm_Q--~A

Request Chain 273

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=1OY__EiBQsy4vHLQ-rKJuA&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=1OY__EiBQsy4vHLQ-rKJuA

294 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 422054 Show response
forums.babypips.com/t/curtis-fox-forex-scammer/ 178 KB
28 KB 1372ms
751ms Document
text/html 34.224.142.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.142.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-224-142-149.compute-1.amazonaws.com

Software

nginx /

Resource Hash

557977af8d7c5c1c1ca7ff891c0c4a539ece895dd643866ba78493c1780278ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-cache, no-store
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 14 Dec 2022 03:33:43 GMT
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-discourse-cached: skip
x-discourse-route: topics/show
x-discourse-trackview: 1
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 90245d92-10b5-4d8d-a941-f6f99056578d
x-runtime: 0.165913
x-xss-protection: 1; mode=block

GET
H2 200 color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 4 KB
2 KB 655ms
171ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

484e9d8c0aa2f0c493e081e62b78e5daf1c77787818a16dfe53a3ebab8bf5bae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 2aadb6be-cd5b-498a-9f5c-13e7e73684a5
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:45 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: BzGAeeiIrjDthIu2i4T_ggI3fuFa2dBOxIhIeSumCFt9gPBBNAdr7g==

GET
H2 200 desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 374 KB
68 KB 685ms
201ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

88bf02e57651bd6ed5f6dd802c4103f7088aa1f0872df19f78d4abdcfd4fcfac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:18:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2182485
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 6b96f8d7-b75f-442f-b509-088bf04639f3
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:45 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: -QvnoBnIPlUmZYz2WHxVob6TPUU37V7zGZ6tPn_y9uoovPJCYq3jTw==

GET
H2 200 discourse-akismet_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 2 KB
1 KB 885ms
402ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-akismet_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

7fdd173b8ae243b9a321c3637c562cd2e9b2053b1320c17d58627a117d00a5e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-akismet_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-akismet_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: dde206fa-48f3-42b1-b38f-32f290e24c57
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:46 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: voJrro4UcTNrWCGuJoQ9h-JybA_p69i80NHrVJYXjyudcRN7TDsbYQ==

GET
H2 200 discourse-babypips-theme_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 234 KB
33 KB 922ms
439ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-babypips-theme_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

79a05930356f93de515ecf8173134ec0c28e15b712e95413ba4f379ff6601893

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-babypips-theme_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-babypips-theme_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 92f78b97-e47e-4eeb-bf62-9f558348660a
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:46 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: dfuqzU7cnwcNuYeGNaSCalKEjEYGpEWyEamqowsYfkX9DuO5IRv87Q==

GET
H2 200 discourse-details_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 3 KB
2 KB 1015ms
532ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-details_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

ef68d22360154317ff26a3b00fb3616489a211161d3d32af5e0394fbcadd6646

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-details_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-details_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: ee86f77f-7665-4693-825e-6e913f398340
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:46 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: FZY6fYosoe0I24Gs4zS3XzBNF5hkGpaY3GzHe4edkh0Alz6SLtusWA==

GET
H2 200 discourse-follow_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 2 KB
1 KB 888ms
406ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-follow_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

f29d46e273115e3b561afc0e2fd41543a2f7705aeda0d5bf060bdb755b9f78d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-follow_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-follow_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 5d641a83-d76b-4579-8b12-5e8bc3992ad4
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:46 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 05N3QBwYTuBtWVpb1J-V7qPR0uO5PGY5VvREII1XdBz3D1A-KxIvbg==

GET
H2 200 discourse-local-dates_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 9 KB
2 KB 1009ms
527ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-local-dates_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

a9f899953a47d5920ec441ecf4dad0b8907fd2b8bfe10857a6cdcbca0856b623

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 00:01:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2172732
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-local-dates_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-local-dates_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 7aa41582-16bc-4d42-a1f6-d3f56e765d2f
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:46 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: kVdnJ_Nw6WfFOYiTmHNj3zWrr3Jjoatj9fcMtOx-ZjFwC5RNOM7_Yw==

GET
H2 200 discourse-narrative-bot_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 2 KB
1 KB 1021ms
539ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-narrative-bot_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

612d16789237243a86b1c3c7ce0ac9b619b6bb1286e01a27402f6aa28ae9700a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-narrative-bot_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-narrative-bot_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: c0c78f46-f21e-4983-924c-9fc0cd8b935f
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:46 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: j5vSvzKR9gp-qDST44Ud0oyYgQK_BqfuWPwnEg0rrcJjeJrIaGU3bA==

GET
H2 200 discourse-presence_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 3 KB
2 KB 1023ms
541ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-presence_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

ddc9ba2b04958970bed2b6db6ae1fe7d35a99fab13a513d6ca28fa54a16377f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-presence_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-presence_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 11b99d5e-36cd-4557-b001-fb716d414e19
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:46 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: FEYlgm6TQAAPLeKTG3q09Yj7v4LoKoQZFfUdzqTlE74XrV9V6zZ1iA==

GET
H2 200 discourse-staff-notes_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 3 KB
2 KB 1012ms
531ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-staff-notes_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

8f16871be8079e2ef038c404ac4ec3ebf5e07a4cf1860a9971d5409455cd98d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-staff-notes_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-staff-notes_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: d7d5d9a3-4f47-46d4-a75a-f1ee74eb36c7
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:47 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: su_FBTZ86GiUhXlBPsuAzjxuKgLdDY52U1Uqr-1KWBiltvM9wgUqpA==

GET
H2 200 discourse-yearly-review_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 2 KB
2 KB 1029ms
549ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/discourse-yearly-review_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

385aeac960c303b2810d72d3c7f776665a15d2f84d0ac5d1345e1c0a154cd604

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-yearly-review_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''discourse-yearly-review_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 4627db11-6d4d-4354-a59d-c985236d675e
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:47 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 82PBeBAXl7cd_CpGJOscXxqRlk0gXIAsTM5xtskr9U6r3D93kkZ4Fg==

GET
H2 200 lazy-yt_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 4 KB
2 KB 891ms
410ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/lazy-yt_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

17ae8213c11a3c486e7c083dd1bed59346670a1221eaa68e3c3191db508555a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="lazy-yt_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''lazy-yt_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: 5d2410a6-c479-4152-9aa1-1449324118f8
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:47 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: VTaMDnHVmcEPxTu5SR0948LQ9Nku6Zt-fha0TNqgIoWSBw7JxOy3yw==

GET
H2 200 poll_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 8 KB
3 KB 1025ms
545ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/poll_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

9c63bd05958b5790ad9961f80ebd3ee3becc8c51b077062e1024e2290e978cc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="poll_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''poll_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: f56e3098-0d63-482e-8cfa-3d27cb711cde
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:47 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: AqyONORra6DjT0o6WCAJOMuqyx-bhr-8hHdpgGem0lXMVjxZ4tF64Q==

GET
H2 200 poll_desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
f.bpcdn.co/stylesheets/ 3 KB
2 KB 1014ms
534ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/poll_desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

0604c8b2ecbf210e0b8ea0b386a26508660e66a42f6857064310db41d783462e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 23:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2087191
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="poll_desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css"; filename*=UTF-8''poll_desktop_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css
x-xss-protection: 1; mode=block
x-request-id: c87f0dcc-86e2-4806-a1b8-3b6f45ef41d9
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:47 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 2XIvgybpDXEMVry04sGHjo7O7iWg9i1puqLGgu4TovIOfjWLGXKVAg==

GET
H2 200 desktop_theme_3_89c42d12c746cc568fc532793dc3e29fb9948fbe.css
f.bpcdn.co/stylesheets/ 2 KB
1 KB 1017ms
538ms Stylesheet
text/css 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/stylesheets/desktop_theme_3_89c42d12c746cc568fc532793dc3e29fb9948fbe.css?__ws=forums.babypips.com

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

1c9aebccb551bd64db9cec18901b0156f3b7bb1bb85b3cfd940f9d18cf658c4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 23:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2087191
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: stylesheets/show
content-disposition: inline; filename="desktop_theme_3_89c42d12c746cc568fc532793dc3e29fb9948fbe.css"; filename*=UTF-8''desktop_theme_3_89c42d12c746cc568fc532793dc3e29fb9948fbe.css
x-xss-protection: 1; mode=block
x-request-id: 8b0a7a53-1791-4d45-b58f-f1316ef6a5d1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:02 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: E_gLXJW7fSp1mqHxzvwOS3l-WZG2XryJ4XUdgEktap_fOgSXrI4a5Q==

GET
H2 200 browser-detect-115ab5953de1b5bb122bfb26b757f5391dd8d1d2aef2b81baf7b59aee99d9f34.js Show response
f.bpcdn.co/brotli_asset/ 247 B
860 B 1058ms
579ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/browser-detect-115ab5953de1b5bb122bfb26b757f5391dd8d1d2aef2b81baf7b59aee99d9f34.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

9487cb559d6168d8f29a5684b10a9c253776e7280ea758f332902773d85367e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 170
x-xss-protection: 1; mode=block
x-request-id: 240a8034-fc9b-4c74-859f-37d7c88cc69e
x-runtime: 0.009420
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: MLkpTzd7wAoGZ1DL2HIwwB2dNe7lZUclBm5JMgy34ys0BB49RnieOQ==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 en-abe31e0265b80b4b5100897ed6656e2fa0ab3bebe464ea8ad3ab32c39ff2c8a5.js Show response
f.bpcdn.co/brotli_asset/locales/ 259 KB
64 KB 1353ms
874ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/locales/en-abe31e0265b80b4b5100897ed6656e2fa0ab3bebe464ea8ad3ab32c39ff2c8a5.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

61b950d5252d06c0948e0c985cee3c34138ca2d419ec5512fa037a9e2d838fcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 64366
x-xss-protection: 1; mode=block
x-request-id: 6c4f4764-8e7e-46ec-95b4-8fbde4dc9fea
x-runtime: 0.008785
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:04 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: CKbmNFkZ4ngUqu0MwvOpabgNQd7rXhGYTObKQthfrdt6Y61NW9VW6w==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 ember_jquery-36a23101c869ab0dc53fc908de69adb785731593573d32bdeef416acc1076ef4.js Show response
f.bpcdn.co/brotli_asset/ 557 KB
131 KB 1268ms
790ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/ember_jquery-36a23101c869ab0dc53fc908de69adb785731593573d32bdeef416acc1076ef4.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

80a64d0e0cf6886659721e6f37817b0eef7e9fbfe331ea1ffe1ca0674a009177

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 20:56:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2097452
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 132910
x-xss-protection: 1; mode=block
x-request-id: 73750869-22fd-4f5b-b428-ec3aa573af79
x-runtime: 0.006624
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:23:44 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: hgP0U1S0xxX76z6hG0xbyBAolUJDNXN-oUT_aylr-ccNeXNd8CDVyA==
expires: Sun, 19 Nov 2023 20:56:12 GMT

GET
H2 200 vendor-dde8b5f2dd41adf78c88e7719455c3a5d4db146cb96d783a2dc1ed978892f200.js Show response
f.bpcdn.co/brotli_asset/ 180 KB
54 KB 1080ms
602ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/vendor-dde8b5f2dd41adf78c88e7719455c3a5d4db146cb96d783a2dc1ed978892f200.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

20795ae824c5aa849754c6c07bcefb0f07dddd8747fa66453204a6b47a9b2cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 54642
x-xss-protection: 1; mode=block
x-request-id: 54a08890-749b-4cf7-b2f3-88294fc132b9
x-runtime: 0.009837
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:05 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: Q2PePuuvkbqPBBgROPSKg1femcL1ikf8q6Rfa-GpGJQrmhTYwXZidw==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 pretty-text-bundle-040ac8329a20a2521202a2d2c59aa36509c83fc079f86105bfd735894194388d.js Show response
f.bpcdn.co/brotli_asset/ 150 KB
36 KB 1380ms
902ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/pretty-text-bundle-040ac8329a20a2521202a2d2c59aa36509c83fc079f86105bfd735894194388d.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

5145bbf30c52715e52d93342062b8c88774ae2b6a96d00d9ac602d976072c9b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 36243
x-xss-protection: 1; mode=block
x-request-id: 8ae63fc8-ca39-4b50-be03-5b84ce28bb7e
x-runtime: 0.009627
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: pfMzHI2FSVczjvFmsyILyFsGiGykuWE990AI4RJ-lVUXpQFSYPmQoA==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 application-02eb5b01b1a1cf955f8e99effc74ea1a09d2012cec1f364a9909c31e66271803.js Show response
f.bpcdn.co/brotli_asset/ 3 MB
375 KB 1148ms
670ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/application-02eb5b01b1a1cf955f8e99effc74ea1a09d2012cec1f364a9909c31e66271803.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

a1403803173e5c95500724ef78b30133febf284c3fcca41aacf0f4b4c01e92ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 20:56:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2097452
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 382571
x-xss-protection: 1; mode=block
x-request-id: 0b662765-6513-415a-b702-5de4fee4480a
x-runtime: 0.008032
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:23:43 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: Z9vDHBfTd1eIlrpDP5MwAtzT2u3eRzad9u5HuSb66CgGM0ppaZOo5g==
expires: Sun, 19 Nov 2023 20:56:12 GMT

GET
H2 200 discourse-akismet-a08146fefce2a5a70d6ea415c3f369b4abaf1d2b09d7287b383f837e3a6b1b42.js Show response
f.bpcdn.co/brotli_asset/plugins/ 6 KB
2 KB 1059ms
581ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-akismet-a08146fefce2a5a70d6ea415c3f369b4abaf1d2b09d7287b383f837e3a6b1b42.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

b4fa332fcf6779f8d263380fc203554bd7c20c65a2c3947a151561db476bff28

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 1142
x-xss-protection: 1; mode=block
x-request-id: b818bc22-0e87-4728-933b-2b3f46462663
x-runtime: 0.010965
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 4W1bhOmXhW3YP2Uoj2jNTESn0ETGafqpSmmpchqzdpeilsxE8vp8Fw==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-babypips-theme-9f6b7fae7427fce9abdc4a64af6604115d1c19a30ef5b2a5f4abcc082dcc65ad.js Show response
f.bpcdn.co/brotli_asset/plugins/ 68 KB
14 KB 1345ms
868ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-babypips-theme-9f6b7fae7427fce9abdc4a64af6604115d1c19a30ef5b2a5f4abcc082dcc65ad.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

f9e5f0c55e7870d1af66deb9a35eeed0e62abefb64e3d57a415f10aff7e9facc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 13981
x-xss-protection: 1; mode=block
x-request-id: 37d42709-4054-4fdd-b348-6d3382921843
x-runtime: 0.017403
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:05 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: WkeHxzzSll_sA4bp2fY_Vp0jc3IlaFDZsMHak8kPvJvih3MYhgQvtg==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-bcc-a89248717844e12511618ad23dbd0a8e64efb6807e36691c1e4607918c943542.js Show response
f.bpcdn.co/brotli_asset/plugins/ 3 KB
2 KB 1255ms
778ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-bcc-a89248717844e12511618ad23dbd0a8e64efb6807e36691c1e4607918c943542.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

4d0937fc80c0e26fa6055594c5af2e4e0aa0187766ffc41899e215543a3e3d30

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 1105
x-xss-protection: 1; mode=block
x-request-id: 7f5129b8-f879-4415-adb0-a33e6486f6a9
x-runtime: 0.008392
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:05 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 1aYWgfltlOUw_gcJpcHeB_MeoJYIgNADbcKLZnbL_L6DokitPqHgvQ==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-details-61554ea83ad59329c2d5c9f0390a0498f3e3665deb58d32dc608aeca24fa0bb9.js Show response
f.bpcdn.co/brotli_asset/plugins/ 1 KB
1 KB 1055ms
578ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-details-61554ea83ad59329c2d5c9f0390a0498f3e3665deb58d32dc608aeca24fa0bb9.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

6faf7671423b25917268e318f3b4c59344aa8e901b29b99e3348f2123b7e5d82

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 636
x-xss-protection: 1; mode=block
x-request-id: ddaefe3b-026c-4105-98da-7e664dcc679d
x-runtime: 0.010584
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: pA0X-xhxS90rxDTGRwzbjc__HcnOfVCokgUi2micPNXwjRQK99T4Fw==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-follow-c26b3591da1d8df11292de8a2d1382547d53f70481268143655cbde0846056f4.js Show response
f.bpcdn.co/brotli_asset/plugins/ 25 KB
5 KB 1392ms
916ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-follow-c26b3591da1d8df11292de8a2d1382547d53f70481268143655cbde0846056f4.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

079cb31267c2a22f48cd702e20e4a07562b1099cf8d2cd987a9c46e888361253

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 4505
x-xss-protection: 1; mode=block
x-request-id: 8967f891-2a40-4276-9e1f-505d9396350f
x-runtime: 0.008046
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:23:44 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: lJDfOhUWdYdNiTwlSQOKOnTevf81yDxNbk91L5lKDoze5yViUktwmg==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-local-dates-25f72649ac746ac9b287c1ef1838e8be4a461c30e597ee92dc54a4d3fb525a36.js Show response
f.bpcdn.co/brotli_asset/plugins/ 32 KB
8 KB 1390ms
914ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-local-dates-25f72649ac746ac9b287c1ef1838e8be4a461c30e597ee92dc54a4d3fb525a36.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

3bcf66c42bfc0b91d9bd738779118c6e9d15ce7f1232f63f2b86dc68625bd019

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 7538
x-xss-protection: 1; mode=block
x-request-id: 4f3eb944-479a-4da8-8106-d3dfead26471
x-runtime: 0.007028
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:23:44 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: GybyceoEk4fyi0F2gosQATWhkSbb6bF0NyxsW58MCbOc0WYmyDKM8Q==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-narrative-bot-0b1e40d099d739cee23bbad45c2fb5eac1dcaaba028fdc9fa21b9e32930ec40b.js Show response
f.bpcdn.co/brotli_asset/plugins/ 1 KB
1 KB 1345ms
869ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-narrative-bot-0b1e40d099d739cee23bbad45c2fb5eac1dcaaba028fdc9fa21b9e32930ec40b.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

a6915794955aa02a862c6286b6ae26b9ad45b49d9a095ecd1c9d1b7f8b498778

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 667
x-xss-protection: 1; mode=block
x-request-id: babdd4a1-37cc-40c6-8623-c4f421ef5250
x-runtime: 0.009591
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:05 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: o_-dD8xZTfuUAht1N5WazIH2QlKYteutUO5EfJtkfIbZmhJ_Z_65DA==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-presence-e575490133b5e948d5db094ba04f265c777e7d5003f1b418d1b7a38c8f64a317.js Show response
f.bpcdn.co/brotli_asset/plugins/ 13 KB
4 KB 1386ms
911ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-presence-e575490133b5e948d5db094ba04f265c777e7d5003f1b418d1b7a38c8f64a317.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

c7d7cc87200cabfd3db4669ab3b7ff421ae78d8b9311d10d4f0888e0ec29f333

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 2912
x-xss-protection: 1; mode=block
x-request-id: e0bdf68b-e85f-4815-9528-2004c8e22594
x-runtime: 0.010202
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: m2pDCAzB62Z7s1yx2D3q7IHb-pklEyDyc50m0GOCzKlYId-9lrVc6Q==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 discourse-staff-notes-d7d9775a8a98c340e3e4c2be406b6c6a8bf478f85f2cc7f2754a476e5a221ad5.js Show response
f.bpcdn.co/brotli_asset/plugins/ 15 KB
4 KB 1032ms
556ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/discourse-staff-notes-d7d9775a8a98c340e3e4c2be406b6c6a8bf478f85f2cc7f2754a476e5a221ad5.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

26fb3657b5d5837dcd8a818b3989cfa2489ce251e40e0d023566eea8946bb07d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 3164
x-xss-protection: 1; mode=block
x-request-id: 266de4b0-a8d6-4495-8cc3-d921c579f3f4
x-runtime: 0.009878
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:25:05 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: P0OpIo3BPzsgE8emPH5CudsHLOEtvPuLk3QhqXNDr3eJIUIbXWcGbA==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 lazy-yt-4e94ac3522a311236b5b7b0cf0ad4f98ee8632f45a4c686ac5b6676fcabe6f78.js Show response
f.bpcdn.co/brotli_asset/plugins/ 5 KB
3 KB 1393ms
918ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/lazy-yt-4e94ac3522a311236b5b7b0cf0ad4f98ee8632f45a4c686ac5b6676fcabe6f78.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

16c3a3e3f45b425c2ee002ecfe86f9a3e6e8268d6474a1adeeb13d32a9dd760a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 1902
x-xss-protection: 1; mode=block
x-request-id: 462056a0-e2df-4f12-9a40-c2651b4f1bf3
x-runtime: 0.033854
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 1_W51_xjU1KIasCIpxXxRMpOAS3iPUtSFOuItvuvtyqxf2IbYGiYWQ==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 poll-c333b847702e729ea25fc8467eebf06b91461ffbad746f95ef1103e018de92f4.js Show response
f.bpcdn.co/brotli_asset/plugins/ 59 KB
14 KB 1049ms
574ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/plugins/poll-c333b847702e729ea25fc8467eebf06b91461ffbad746f95ef1103e018de92f4.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

7362d3a1621d8f7e4e7ab5d812ec8a2f1fb1c69a1a79b6f885e68b7e2bc1bdae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 13665
x-xss-protection: 1; mode=block
x-request-id: a67000f5-a938-494a-905f-2ee053bd1d4d
x-runtime: 0.009397
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:23:44 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 5jZCDn6Dhw1RLkE1PyMaP9pcH6RzY37joXGnm9OHvoTXmF6HxMxLGA==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 otSDKStub.js Show response
cookie-cdn.cookiepro.com/scripttemplates/ 21 KB
8 KB 298ms
120ms Script
application/javascript 104.18.3.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cookie-cdn.cookiepro.com/scripttemplates/otSDKStub.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.3.3 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
content-md5: bKkFjZE43AfZo3jm8gqLew==
age: 12811
x-ms-lease-status: unlocked
last-modified: Fri, 02 Dec 2022 02:44:42 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 4c8ab55a-601e-0004-6d9f-06b54a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
cf-ray: 7793e133f92b5aac-MEL
expires: Thu, 15 Dec 2022 03:33:43 GMT

GET
H2 200 google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js Show response
f.bpcdn.co/brotli_asset/ 725 B
1 KB 1025ms
550ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

19089746082c9d1ae6b7fb6e3218eafa4411abffe26412d4d823cb304683c045

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 340
x-xss-protection: 1; mode=block
x-request-id: 4b8986ba-951e-4c44-9892-ca72fe1a604b
x-runtime: 0.007821
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:23:44 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: 1EP4O_yUhC462ncphs3RcWn1aB9JHCiQ81bwL2XEayZ4mvzqfu7thQ==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 start-discourse-efa4e5abfbd1b50b5152ffbe64d5dcea9f7c33f766dcc6387e2711f0f2112148.js Show response
f.bpcdn.co/brotli_asset/ 135 B
814 B 1392ms
917ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/start-discourse-efa4e5abfbd1b50b5152ffbe64d5dcea9f7c33f766dcc6387e2711f0f2112148.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

36e56ff433d1e7c0017688ed51d42dea37fc7a90431b54d4568df80746ed349b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 123
x-xss-protection: 1; mode=block
x-request-id: d823c7ec-53ac-4055-b6d9-1910c62249be
x-runtime: 0.010087
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: ySgFJEbjooFAk6MRfkhd7dBXt70hkQ-_EKkMXbiMPyuvXbs7ekVHMw==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 browser-update-eec13eb6f8386f18f10b5dd6ebb7a3598d28421bb796e539b91a7e4a4c5d4c08.js Show response
f.bpcdn.co/brotli_asset/ 2 KB
1 KB 1391ms
917ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/browser-update-eec13eb6f8386f18f10b5dd6ebb7a3598d28421bb796e539b91a7e4a4c5d4c08.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

a933fa87d48ac7c2f381036d364fa92767c5dae738491b16aa668671abc23442

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 640
x-xss-protection: 1; mode=block
x-request-id: 448f87e0-dde4-49ac-b58b-2f60e407bdb5
x-runtime: 0.009585
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: hL7MdB-D2k465eK7JOdqlFVsFX6DbKqNda4ZASsjkLs1xDPUXXu5Yg==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js Show response
f.bpcdn.co/brotli_asset/ 2 KB
1 KB 171ms
170ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/brotli_asset/bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

9063a2202d854d610e7ad376068af697120c76a05023d93bdccdd04631818b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:16 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
content-transfer-encoding: binary
x-discourse-route: static/brotli_asset
content-length: 821
x-xss-protection: 1; mode=block
x-request-id: c755107a-eb2a-440c-a752-c4241e57fc97
x-runtime: 0.011598
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 08 Nov 2022 20:24:56 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: KnglpCNDtqFV9qK2E6kwt5vIzCQ-O-wYmEOplEynri-8I-qnVE6pMA==
expires: Sun, 19 Nov 2023 21:16:16 GMT

GET
H2 200 10a211bf-7222-4f26-8d42-029eab9f8e26.json Show response
cookie-cdn.cookiepro.com/consent/10a211bf-7222-4f26-8d42-029eab9f8e26/ 4 KB
2 KB 289ms
115ms XHR
application/x-javascript 104.18.3.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cookie-cdn.cookiepro.com/consent/10a211bf-7222-4f26-8d42-029eab9f8e26/10a211bf-7222-4f26-8d42-029eab9f8e26.json

Requested by

Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.3.3 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93fba53f976df6698cfc988486ed1cfe33f04d05fb9942b6f4517d3ffbfffe27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
content-md5: 0qhA+3AV11MyDxZZlUftgw==
age: 54549
x-ms-lease-status: unlocked
last-modified: Tue, 19 Apr 2022 03:09:56 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: e3a86b7e-e01e-0078-786a-de9bb5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 7793e13e3b0e5a85-MEL

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 671ms
223ms Script
text/javascript 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 14 Dec 2022 03:30:11 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 214
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Wed, 14 Dec 2022 05:30:11 GMT

GET
H2 200 svg-3-63ce27905d345a22329cbfc189f793cf2b5c3a28.js Show response
f.bpcdn.co/svg-sprite/forums.babypips.com/ 220 KB
67 KB 172ms
172ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.bpcdn.co/svg-sprite/forums.babypips.com/svg-3-63ce27905d345a22329cbfc189f793cf2b5c3a28.js

Requested by

Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/application-02eb5b01b1a1cf955f8e99effc74ea1a09d2012cec1f364a9909c31e66271803.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.8.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-8-23.sin5.r.cloudfront.net

Software

nginx /

Resource Hash

19cc1693a6c9244060a83f61b8832c624cadcc3ef5956a44be0197cfb13b215c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 2096248
x-cache: Hit from cloudfront
x-discourse-route: svg_sprite/show
x-xss-protection: 1; mode=block
x-request-id: d8b0ddc9-b76e-490c-ab8f-445b36ffa9cb
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Nov 2012 21:16:17 GMT
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: Z1CF-KmpV95F7LgeJxC7rz-J3vT_aGE-kxYvT2oNnF6YEx3DKEzASQ==

GET
H2 200 vagrundschriftd-webfont.woff2
f.bpcdn.co/plugins/discourse-babypips-theme/fonts/ 18 KB
19 KB 542ms
195ms Font
font/woff2 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://f.bpcdn.co/plugins/discourse-babypips-theme/fonts/vagrundschriftd-webfont.woff2
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/stylesheets/color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 5bac968f26265cb7afcd5c0203da3b7985105f8f0de97e84f9c12f7557e1de26

Request headers

Referer: https://f.bpcdn.co/stylesheets/color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com
Origin: https://forums.babypips.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 08:45:13 GMT
via: 1.1 d7fd5c1c255d6d9fadc2a242ff9a2774.cloudfront.net (CloudFront)
last-modified: Tue, 08 Nov 2022 16:31:35 GMT
server: nginx
x-amz-cf-pop: SIN5-C1
age: 2227712
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public,immutable
accept-ranges: bytes
content-length: 18896
x-amz-cf-id: aeqGl5NEvro-9stPKzY5_AIapdsV3OiQtqOI10ayeo-0V2gK3awtaA==
expires: Sat, 18 Nov 2023 08:45:13 GMT

GET
H2 200 vagrundschriftd-lig-webfont.woff2
f.bpcdn.co/plugins/discourse-babypips-theme/fonts/ 17 KB
18 KB 542ms
195ms Font
font/woff2 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://f.bpcdn.co/plugins/discourse-babypips-theme/fonts/vagrundschriftd-lig-webfont.woff2
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/stylesheets/color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 88ca76900e2f34e199615b84ec4f674dd5854d0ff18a10778a6112a096435abd

Request headers

Referer: https://f.bpcdn.co/stylesheets/color_definitions_babypips_1_c90418006d56af2d873bc2bf3c36942c9c5fdfd6.css?__ws=forums.babypips.com
Origin: https://forums.babypips.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:18:57 GMT
via: 1.1 d7fd5c1c255d6d9fadc2a242ff9a2774.cloudfront.net (CloudFront)
last-modified: Tue, 08 Nov 2022 16:31:35 GMT
server: nginx
x-amz-cf-pop: SIN5-C1
age: 2096088
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public,immutable
accept-ranges: bytes
content-length: 17736
x-amz-cf-id: IsDhvSwPp6je3EvUANEX6xOPqC_zwyxmptP4Pd9oYwoGYKvr1NGtmA==
expires: Sun, 19 Nov 2023 21:18:57 GMT

GET
H2 200 jquery.magnific-popup.min.js Show response
f.bpcdn.co/javascripts/magnific-popup/1.1.0/ 20 KB
8 KB 172ms
171ms Script
application/javascript 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://f.bpcdn.co/javascripts/magnific-popup/1.1.0/jquery.magnific-popup.min.js
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/application-02eb5b01b1a1cf955f8e99effc74ea1a09d2012cec1f364a9909c31e66271803.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 02:11:06 GMT
content-encoding: gzip
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
last-modified: Tue, 08 Nov 2022 16:31:26 GMT
server: nginx
x-amz-cf-pop: SIN5-C1
age: 4959
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400, public,immutable
x-amz-cf-id: JR8SV1DllZv7gKnqzU1YRwfYgMwO_poQM7rXPDc77i_xbTp_hgQunw==
expires: Thu, 15 Dec 2022 02:11:06 GMT

GET
H2 403 cdefff4af52a8d2d43094b5d57ebca1fc7613a63.js
f.bpcdn.co/highlight-js/forums.babypips.com/ 0
0 1181ms
1180ms Script
application/xml 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://f.bpcdn.co/highlight-js/forums.babypips.com/cdefff4af52a8d2d43094b5d57ebca1fc7613a63.js
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/application-02eb5b01b1a1cf955f8e99effc74ea1a09d2012cec1f364a9909c31e66271803.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dbc9ff2bfb671be765584f419efb6ab75b4c0f861d3e532d7bd695cc5e932e13

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=US-ASCII

GET
H2 200 90d2d6ffeaa23f1fbd8021365ac6e659e614d246.svg
f.bpcdn.co/original/4X/9/0/d/ 6 KB
2 KB 173ms
170ms Image
image/svg+xml 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/original/4X/9/0/d/90d2d6ffeaa23f1fbd8021365ac6e659e614d246.svg
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 94b58f937eda4052c487b5aa11553b3526fea48cf8421e920ccec7b6468ba111

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 21:16:19 GMT
content-encoding: gzip
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-amz-version-id: null
last-modified: Fri, 27 Mar 2020 21:29:13 GMT
server: AmazonS3
x-amz-cf-pop: SIN5-C1
age: 2096247
etag: W/"6e9035d39dcb564ced46582b5f5c6167"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: max-age=31556952, public, immutable
x-amz-cf-id: ELMLnK1M29m6jVFyfDKn0Qb6qh-WWSTm5hwXFjP_CFjIreeufVgdtw==

GET
H2 200 45.png
f.bpcdn.co/letter_avatar_proxy/v4/letter/h/8e8cbc/ 491 B
935 B 1176ms
1172ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/letter_avatar_proxy/v4/letter/h/8e8cbc/45.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 81b9f3fd26ebc3ae316736187c3e6380e80fa9b02a406b59c7cde735354e192e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
last-modified: Mon, 14 Mar 2022 05:20:08 GMT
server: nginx
x-amz-cf-pop: SIN5-C1
x-edge-location: usda
x-cache: Miss from cloudfront
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
content-length: 491
x-amz-cf-id: 5uqvxeH3hQS9XaE76MV6VKxrydGJK7d5c-B1HPg7G361upRYYztKvQ==
cdck-proxy-id: corp-router-tiehunter01.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Tue, 03 Dec 2024 00:00:00 GMT

GET
H2 200 20.png
f.bpcdn.co/letter_avatar_proxy/v4/letter/h/8e8cbc/ 378 B
821 B 1017ms
1013ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/letter_avatar_proxy/v4/letter/h/8e8cbc/20.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 573de750ad1066af5236424fc3f691a974660b9a26cbabfa50d388b499cb2912

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
last-modified: Mon, 14 Mar 2022 08:23:04 GMT
server: nginx
x-amz-cf-pop: SIN5-C1
x-edge-location: usda
x-cache: Miss from cloudfront
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
content-length: 378
x-amz-cf-id: Pr1PYDSi85aDAeGW3xu9oCtLHI3-5Oe0nAIicWsK5ULOmxQvUPSbVg==
cdck-proxy-id: corp-router-tiehunter01.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Tue, 03 Dec 2024 00:00:00 GMT

GET
H2 200 20.png
f.bpcdn.co/letter_avatar_proxy/v4/letter/m/82dd89/ 470 B
924 B 175ms
171ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/letter_avatar_proxy/v4/letter/m/82dd89/20.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 1bbf38f752477763f1db36d42b5cc451c2b0e692d192fb028669e4d086c78d06

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sun, 11 Dec 2022 14:36:38 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN5-C1
x-edge-location: usda
age: 219427
x-cache: Hit from cloudfront
content-length: 470
last-modified: Mon, 14 Mar 2022 06:41:15 GMT
server: nginx
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
x-amz-cf-id: Nv-zWZs1OWJfMwYiMsFeViy60Nag2YkCWUCOpqk2OQhRBvWW4Kfmvw==
cdck-proxy-id: corp-router-tiehunter02.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Thu, 28 Nov 2024 00:00:00 GMT

GET
H2 200 32.png
f.bpcdn.co/letter_avatar_proxy/v4/letter/h/8e8cbc/ 478 B
922 B 1151ms
1147ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/letter_avatar_proxy/v4/letter/h/8e8cbc/32.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: f60a67ba607267a113dd702a13de30fb6b08b278ea6eefe34d09d0400e25a53f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
last-modified: Mon, 14 Mar 2022 06:01:05 GMT
server: nginx
x-amz-cf-pop: SIN5-C1
x-edge-location: usda
x-cache: Miss from cloudfront
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
content-length: 478
x-amz-cf-id: g0UphvxrqTvk6kBD_gXA0U6vViFC4D4T5A3KNk58fUY6ZAT07Ylslw==
cdck-proxy-id: corp-router-tiehunter01.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Tue, 03 Dec 2024 00:00:00 GMT

GET
H2

200

6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_32x32.jpeg
f.bpcdn.co/optimized/3X/6/c/
Redirect Chain

https://f.bpcdn.co/user_avatar/forums.babypips.com/ria_rose/32/182332_2.png
https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_32x32.jpeg

1 KB
2 KB

171ms
171ms

Image
image/jpeg

13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_32x32.jpeg
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bea4a236e94508496310b0f6ba7c4ef2e34f379fc5712c2ee28c663812a4b710

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 19:34:47 GMT
x-amz-version-id: null
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
last-modified: Fri, 27 Mar 2020 21:43:29 GMT
server: AmazonS3
x-amz-cf-pop: SIN5-C1
age: 374339
etag: "66269fd8180445fca99c947485a76931"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31556952, public, immutable
accept-ranges: bytes
content-length: 1255
x-amz-cf-id: x19hUPnYm9K2nm46VFpxUKDwv9pEJf39ZY80zWpEtXaAn0l1QuZPng==

Redirect headers

date: Tue, 13 Dec 2022 15:49:40 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 42245
x-cache: Hit from cloudfront
x-discourse-route: user_avatars/show
content-length: 155
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
location: https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_32x32.jpeg
x-amz-cf-id: sT5OdQbLXnXMEAKXq3mn01U7liipnKEqo69Rk59shnTQCM02AXRi_w==

GET
H2 200 32.png
f.bpcdn.co/letter_avatar_proxy/v4/letter/m/82dd89/ 657 B
1 KB 176ms
172ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/letter_avatar_proxy/v4/letter/m/82dd89/32.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 175f1a33bfa3061d79c78b2011a5fe36a906a58d64a85ad0f925e79201dbeb81

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sun, 11 Dec 2022 14:36:38 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN5-C1
x-edge-location: usda
age: 219427
x-cache: Hit from cloudfront
content-length: 657
last-modified: Mon, 14 Mar 2022 10:34:34 GMT
server: nginx
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
x-amz-cf-id: G6-fTx5eVqzlTenJ63iwjdzhPWbbzarDgqP5VGxCHCOPlmiy_7ib_A==
cdck-proxy-id: corp-router-tiehunter02.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Fri, 29 Nov 2024 00:00:00 GMT

GET
H2

200

6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_45x45.jpeg
f.bpcdn.co/optimized/3X/6/c/
Redirect Chain

https://f.bpcdn.co/user_avatar/forums.babypips.com/ria_rose/45/182332_2.png
https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_45x45.jpeg

2 KB
2 KB

171ms
170ms

Image
image/jpeg

13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_45x45.jpeg
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bd77054232ed0c5d26790a41cb1fc680313006286e56c7aad7179a0dfc57d1fe

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 14 Nov 2022 00:20:27 GMT
x-amz-version-id: null
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
last-modified: Fri, 27 Mar 2020 21:38:20 GMT
server: AmazonS3
x-amz-cf-pop: SIN5-C1
age: 2603599
etag: "f1838bb57dc2b8d31d8de733f9916db4"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31556952, public, immutable
accept-ranges: bytes
content-length: 2028
x-amz-cf-id: lPHeZ2gmva1vF4rkMXJei_oEv2u8IZBAxyl3g9qwL8pRScZpVtv0xw==

Redirect headers

date: Tue, 13 Dec 2022 07:00:49 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: SIN5-C1
age: 73976
x-cache: Hit from cloudfront
x-discourse-route: user_avatars/show
content-length: 155
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
location: https://f.bpcdn.co/optimized/3X/6/c/6c06b9f1719c95646787a012a0ccdc2e58a1aadc_2_45x45.jpeg
x-amz-cf-id: _XofeGUeaugIIARxTmml2tPmyHWu_XW6HL0-KEGwWRHVAb5_KeWR2A==

GET
H2 200 open_mouth.png
f.bpcdn.co/images/emoji/twitter/ 590 B
978 B 176ms
173ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/images/emoji/twitter/open_mouth.png?v=9
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 53b4e8485067f1290a047a4a938e79e03a18cc18046c0d7d65912487b13f8b91

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 07:55:56 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
last-modified: Tue, 08 Nov 2022 16:31:26 GMT
server: nginx
x-amz-cf-pop: SIN5-C1
age: 934669
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000, public,immutable
accept-ranges: bytes
content-length: 590
x-amz-cf-id: xBjbh-c_ZR8JC7dgIiDsxHIuParw9DaIa_G9MXUr54iMSuVdq9qVbg==
expires: Sun, 03 Dec 2023 07:55:56 GMT

GET
H2 200 45.png
f.bpcdn.co/letter_avatar_proxy/v4/letter/b/e79b87/ 707 B
1 KB 176ms
174ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/letter_avatar_proxy/v4/letter/b/e79b87/45.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: c009974b7a72da3bc9373f1374e6f02be5631bcfe688196e76ab04670271a9a7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 10 Dec 2022 10:41:20 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN5-C1
x-edge-location: usda
age: 319945
x-cache: Hit from cloudfront
content-length: 707
last-modified: Mon, 14 Mar 2022 05:17:41 GMT
server: nginx
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
x-amz-cf-id: m0_bqcFmzBBHXsOMr4b3a2A0VQezXw8Dzovf5ZNe5w20ul0FzFwBDw==
cdck-proxy-id: corp-router-tiehunter01.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Thu, 28 Nov 2024 00:00:00 GMT

GET
H2 200 40.png
forums.babypips.com/letter_avatar_proxy/v4/letter/f/6a8cbe/ 460 B
760 B 392ms
390ms Image
image/png 34.224.142.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://forums.babypips.com/letter_avatar_proxy/v4/letter/f/6a8cbe/40.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.142.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-142-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 9fb445dd0d866a09fa93ed4ebdc175208bb09ab407126fc5fbae08cca6933e77

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:45 GMT
last-modified: Mon, 14 Mar 2022 05:10:54 GMT
server: nginx
x-edge-location: usda
x-cache: HIT
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
content-length: 460
cdck-proxy-id: corp-router-tiehunter01.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Mon, 02 Dec 2024 00:00:00 GMT

GET
H2 200 45.png
f.bpcdn.co/letter_avatar_proxy/v4/letter/m/82dd89/ 832 B
1 KB 232ms
230ms Image
image/png 13.35.8.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f.bpcdn.co/letter_avatar_proxy/v4/letter/m/82dd89/45.png
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.8.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-8-23.sin5.r.cloudfront.net
Software: nginx /
Resource Hash: 47edd61cea73c8c619ac9807565305641e5a13da7d1998805af938c04770cd99

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 00:54:05 GMT
via: 1.1 7d8cd6b1cab0712d291c381dc839b042.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN5-C1
x-edge-location: usat
age: 527980
x-cache: Hit from cloudfront
content-length: 832
last-modified: Mon, 14 Mar 2022 07:29:11 GMT
server: nginx
content-type: image/png
cache-control: public, max-age=157788000
accept-ranges: bytes
x-shield: active
x-amz-cf-id: eSrsqAmC1TlBnyzvo2sO-uMcXZ0_e07jYRB7wnqCz4u0BBDLa81x4A==
cdck-proxy-id: corp-router-tiehunter02.corp1, corp-balancer-tieinterceptor1a.corp1
expires: Tue, 26 Nov 2024 00:00:00 GMT

GET
H2 200 bpa.js Show response
a.babypips.com/ 7 KB
3 KB 1032ms
668ms Script
application/javascript 13.33.88.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a.babypips.com/bpa.js

Requested by

Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.88.57 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-88-57.sin2.r.cloudfront.net

Software

Resource Hash

b43c593785438b113e3a75f0bb5b31b8b34a3bb49da7a184bfb50c72fa876b34

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains; preload; always;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=315360000; includeSubDomains; preload; always;
via: 1.1 9725312341802185c9ebf086bf95544e.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Thu, 08 Dec 2022 17:08:19 GMT
etag: W/f789cbd4d44e61ce98468d28cd77f7d0
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: private, max-age=900
x-amz-cf-id: cy3Le9PmYJnF9C5LhJNBKw-p48NuiHlxybOOyLRP9BlOSCWjwYgp-g==
expires: Wed, 14 Dec 2022 03:48:46 GMT

GET
H2 200 script.js Show response
a.bpcdn.co/js/ 1 KB
2 KB 877ms
292ms Script
text/plain 34.224.142.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.bpcdn.co/js/script.js
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.142.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-142-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 7b2355e9443af0a78ad159061a3b97388239f454d74869dee0192b3e10c31c69

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
last-modified: Wed, 06 Jul 2022 14:39:35 GMT
server: nginx
etag: "62c59ea7-547"
content-type: text/plain
cache-control: max-age=604800, public, no-transform
accept-ranges: bytes
content-length: 1351
expires: Wed, 21 Dec 2022 03:33:46 GMT

GET
H2 200 js Show response
static.getclicky.com/ 15 KB
5 KB 315ms
133ms Script
text/javascript 104.16.221.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.getclicky.com/js
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.221.29 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f164b7d1707684b6749eb2f5154c84883cb9ec621dca72fc5147772b3c4237ff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

expires: Wed, 14 Dec 2022 19:37:34 GMT
date: Wed, 14 Dec 2022 03:33:45 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 07 Dec 2022 19:37:34 GMT
server: cloudflare
age: 546971
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=604800
cf-ray: 7793e140a90917c9-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-proxy-cache: HIT

GET
H2 200 hotjar-66086.js Show response
static.hotjar.com/c/ 8 KB
4 KB 526ms
177ms Script
application/javascript 18.155.68.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-66086.js?sv=6

Requested by

Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-111.sin52.r.cloudfront.net

Software

Resource Hash

246773ec64f9df778c7a95f8ab4085d934beb0619448aac72ecd74a6edc5af7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Wed, 14 Dec 2022 03:33:45 GMT
via: 1.1 0baa68530535d25b0fce15971fbb91e8.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN52-P1
age: 15
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/87df173ef62109f6b8d09fcfd78199a1
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: RkS5bi2FRIHbYlp4u336W7DByCK0jEidu10DfilsunT8OP9uWR0LzQ==

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 54 KB
18 KB 596ms
196ms Script
text/javascript 65.9.164.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.164.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-164-14.bkk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee495ae6f2eb9df7c28df85eac0ad1115411f90ba914e0e38bece9a27eee9216

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

X-Amz-Version-Id: HxiQkfNNaq6NdPfpSv2XZDgmW1WMNL2M
Content-Encoding: gzip
Via: 1.1 ad9f16319579c2656a17ca22a76ee536.cloudfront.net (CloudFront)
Date: Wed, 14 Dec 2022 02:36:41 GMT
Age: 3439
X-Amz-Cf-Pop: BKK50-C1
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Tue, 13 Dec 2022 18:04:23 GMT
Server: AmazonS3
Etag: W/"6be3bd3bef30f48b2e3dbb3f77261989"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: MbcKlKttFkmeX3gsP5jHvHtiABYv2Cj4Rx2cOinnpVucNvu0CxUK8A==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 103 KB
28 KB 515ms
171ms Script
application/x-javascript 157.240.235.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/bp-analytics-5db09554dfa9860f447a26926c7c0fc9b63824cc2121e58d2d9d3cf206b04371.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.235.1 Singapore, Singapore, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-04-sin6.fbcdn.net

Software

Resource Hash

5d9d7e78e22202af03b2d09ad31952e031e3423006cba4a29fd506c5664c7761

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 14 Dec 2022 03:33:45 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27320
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: cCXqz3yicW81PrKomCtquBR8PU5fpgYzdcZrUfvKphvxkTuGDlOExa5ybLBu7QWfAzJ+v+xaU8Qz/5iQm1PrBA==
x-fb-trip-id: 548340344
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 70 B
308 B 291ms
116ms XHR
application/json 104.18.26.85
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.26.85 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3112293a28c64cbee8a4b661328486c7fd17188429bc15e47802e89728d8ab39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 7793e140af2a3773-MEL
access-control-allow-headers: Content-Type

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 652ms
218ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/application-02eb5b01b1a1cf955f8e99effc74ea1a09d2012cec1f364a9909c31e66271803.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

bdda5fd122f247d9ac522edad66dad0f5874fd9cedd384cb8a974558b28d6837

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27541
x-xss-protection: 0
server: sffe
etag: "1421 / 206 of 1000 / last-modified: 1670587517"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 14 Dec 2022 03:33:46 GMT

GET
H2 200 otBannerSdk.js Show response
cookie-cdn.cookiepro.com/scripttemplates/6.24.0/ 317 KB
73 KB 110ms
110ms Script
application/javascript 104.18.3.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/otBannerSdk.js

Requested by

Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.3.3 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec2f6762f857fdc509ffa369c2b398982af1fa6cd2c0298d6088046fa757b852

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
content-md5: V5hcbF1dEgrls6P2M61C9g==
age: 12378
x-ms-lease-status: unlocked
last-modified: Thu, 16 Sep 2021 01:38:26 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f3de32a8-601e-0059-0c6a-debfce000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
cf-ray: 7793e1416cc25aac-MEL
expires: Thu, 15 Dec 2022 03:33:45 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 223ms
222ms XHR
text/plain 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1777195376&t=pageview&_s=1&dl=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&dp=%2Ft%2Fcurtis-fox-forex-scammer%2F422054&ul=en-us&de=UTF-8&dt=Curtis%20Fox%20forex%20scammer%20-%20Commercial%20Content%20%2F%20Scam%20Stories%20-%20BabyPips.com%20Forum&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACACI~&jid=1050925127&gjid=1884831565&cid=729902634.1670988826&tid=UA-103489-6&_gid=2048060353.1670988826&_r=1&_slc=1&z=1140604730

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://forums.babypips.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en.json Show response
cookie-cdn.cookiepro.com/consent/10a211bf-7222-4f26-8d42-029eab9f8e26/782aabec-6b81-4afd-938c-9d4d0d0ef40b/ 156 KB
24 KB 106ms
106ms Fetch
application/x-javascript 104.18.3.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cookie-cdn.cookiepro.com/consent/10a211bf-7222-4f26-8d42-029eab9f8e26/782aabec-6b81-4afd-938c-9d4d0d0ef40b/en.json

Requested by

Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.3.3 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1cfd37041de744e174c8a24e9ba91cf0d8398dcba7c5ae4452237a38e6b5ee9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
content-md5: itzI8NR7+RTwoe4JBgDATg==
age: 54549
x-ms-lease-status: unlocked
last-modified: Tue, 19 Apr 2022 03:10:03 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c7df001e-c01e-000d-226a-def099000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 7793e142dd175a85-MEL

GET
H2 200 in.php Show response
in.getclicky.com/ 133 B
356 B 789ms
265ms Script
text/javascript 198.145.13.13
DF-PTL1

General

Check archive.org

Show headers Download Go to

Full URL: https://in.getclicky.com/in.php?site_id=31313&type=pageview&href=%2Ft%2Fcurtis-fox-forex-scammer%2F422054&title=Curtis%20Fox%20forex%20scammer%20-%20Commercial%20Content%20%2F%20Scam%20Stories%20-%20BabyPips.com%20Forum&res=1600x1200&lang=en-US&tz=Etc%2FUnknown&tc=&ck=1&mime=js&x=0.7185787666168713
Requested by: Host: static.getclicky.com
URL: https://static.getclicky.com/js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.145.13.13 , United States, ASN2044 (DF-PTL1, US),
Reverse DNS: getclicky.com
Software: nginx /
Resource Hash: 3efbb0911716ff301f24daab29e528f6753e528297791bd3cf8fc57fe7866b8b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate, post-check=0, pre-check=0
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 modules.e446dd48ad4c173d0779.js Show response
script.hotjar.com/ 263 KB
68 KB 550ms
203ms Script
application/javascript 54.192.150.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.e446dd48ad4c173d0779.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-66086.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.150.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-150-40.sin2.r.cloudfront.net

Software

Resource Hash

28e7e652bdb6c55c2347e51f218cacfca5645711fa919dc879b25a5c88991aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 14:30:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 6a453f38d14868702eadac9560675990.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-C1
age: 47019
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 68690
last-modified: Tue, 13 Dec 2022 14:30:02 GMT
etag: "e594ec8e48bfdcd811b3aa8ce1ff2044"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: g5n3wCN5xufc4CK95JFwD0XQ9fPB29funeTGfodziOfAS1X8oFFitA==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
442 B 651ms
216ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-103489-6&cid=729902634.1670988826&jid=1050925127&gjid=1884831565&_gid=2048060353.1670988826&_u=IEBAAEAAAAAAACACI~&z=2144276070

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 14 Dec 2022 03:33:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://forums.babypips.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 box-5e66f98b4ee957db209dc6f63e3d59dd.html Show response
vars.hotjar.com/ Frame 0D22 2 KB
1 KB 526ms
171ms Document
text/html 13.33.88.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vars.hotjar.com/box-5e66f98b4ee957db209dc6f63e3d59dd.html

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-66086.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.88.44 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-88-44.sin2.r.cloudfront.net

Software

Resource Hash

cbffce6f8642619af7ed7335e32750f7f2933765d32c113115da0710aa7deadc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1779819
cache-control: max-age=31536000
content-encoding: br
content-length: 1035
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 13:10:07 GMT
etag: "e0652b84b7b3b650769c759fc520c3f8"
last-modified: Wed, 23 Nov 2022 13:09:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
via: 1.1 9f7a987f61c1e9f7d25cd5462f22a14a.cloudfront.net (CloudFront)
x-amz-cf-id: 1xTsiA3wexZtTDygF3fNenY5nHjorsf3IAvDthL6fcfCP6mPNxfaVw==
x-amz-cf-pop: SIN2-P2
x-cache: Hit from cloudfront
x-robots-tag: none

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/WKE6MKSUNNB7PHMNEK4DGH/index.js
https://s.adroll.com/j/exp/index.js

28 B
785 B

372ms
197ms

Script
application/javascript

65.9.164.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 65.9.164.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-164-14.bkk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

X-Amz-Version-Id: 3TnMO1iw0qw17MhnYw4sprJhuU7ahGp7
Date: Wed, 14 Dec 2022 02:39:30 GMT
Via: 1.1 953ae3faac13486af9af1f7195f33160.cloudfront.net (CloudFront)
Age: 33569
X-Amz-Cf-Pop: BKK50-C1
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 28
Last-Modified: Fri, 14 Oct 2022 18:57:24 GMT
Server: AmazonS3
Etag: "5816cced8568d223aa09d889f300692b"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: KuchG-b5-2lpPHtfSKpBF23vXjCdbTqRFeq93jQ1Atw4yfxbd3FUDw==

Redirect headers

Date: Wed, 14 Dec 2022 00:17:43 GMT
Via: 1.1 ad9f16319579c2656a17ca22a76ee536.cloudfront.net (CloudFront)
Age: 11762
X-Amz-Cf-Pop: BKK50-C1
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: RAi5tkQoCE4NBMpaAZK1aIJGynAyyfOj-48-U1yFpLk842s9LX-gKA==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

196ms
196ms

Script
application/javascript

65.9.164.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 65.9.164.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-164-14.bkk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Date: Wed, 14 Dec 2022 03:00:11 GMT
Via: 1.1 ad9f16319579c2656a17ca22a76ee536.cloudfront.net (CloudFront)
Age: 76693
X-Amz-Cf-Pop: BKK50-C1
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: Lo0q_B9wiGAzwoCmCFTUK9ZgQlCN-sNneH3HryGyA6zo81R-ibNWRw==

Redirect headers

Date: Wed, 14 Dec 2022 01:28:53 GMT
Via: 1.1 ad9f16319579c2656a17ca22a76ee536.cloudfront.net (CloudFront)
Age: 7493
X-Amz-Cf-Pop: BKK50-C1
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: aPA1LUHNA56dhOXDBQR3FlGkcq8ess4L1kybptjDndnV6P22t99a_w==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/ 0
809 B 610ms
223ms Script
text/javascript 65.9.164.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.164.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-164-14.bkk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

X-Amz-Version-Id: TUp859h1ZSU0AvDZvZ46o8ftIs.gQr6b
Date: Wed, 14 Dec 2022 03:33:46 GMT
Via: 1.1 22e925143a5372744f821dd8419c8b6c.cloudfront.net (CloudFront)
Age: 2779
X-Amz-Cf-Pop: BKK50-C1
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Thu, 08 Dec 2022 03:33:45 GMT
Server: AmazonS3
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 2xykEIIgxjYp9naVrMNu-Xwtt3M8VR4tLcSrVeAYEVU_qcsbMF3qNw==

GET
H2 200 otFlat.json Show response
cookie-cdn.cookiepro.com/scripttemplates/6.24.0/assets/ 13 KB
3 KB 135ms
135ms Fetch
application/json 104.18.3.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/assets/otFlat.json

Requested by

Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.3.3 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
content-md5: 6kn6x4Mq//asafVxYG5LSA==
age: 54549
x-ms-lease-status: unlocked
last-modified: Thu, 16 Sep 2021 01:38:13 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: f99fa6d7-301e-008f-566a-deb127000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
cf-ray: 7793e143bf325a85-MEL
expires: Thu, 15 Dec 2022 03:33:46 GMT

GET
H2 200 otPcCenter.json Show response
cookie-cdn.cookiepro.com/scripttemplates/6.24.0/assets/v2/ 47 KB
12 KB 125ms
124ms Fetch
application/json 104.18.3.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/assets/v2/otPcCenter.json

Requested by

Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.3.3 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5c7086df4faeb13166aed8770fb13cc3a4a159158221f000c8d4130dfda4815

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
content-md5: 40jAh+GGvTmI/sdgOy4rjw==
age: 54549
x-ms-lease-status: unlocked
last-modified: Thu, 16 Sep 2021 01:38:15 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: f34a1880-101e-00a7-616a-ded08f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
cf-ray: 7793e143bf375a85-MEL
expires: Thu, 15 Dec 2022 03:33:46 GMT

GET
H2 200 otCommonStyles.css Show response
cookie-cdn.cookiepro.com/scripttemplates/6.24.0/assets/ 20 KB
4 KB 115ms
115ms Fetch
text/css 104.18.3.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/assets/otCommonStyles.css

Requested by

Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/6.24.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.3.3 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
content-md5: Ye6OeZcNyuFoWog7CYs00A==
age: 54549
x-ms-lease-status: unlocked
last-modified: Thu, 16 Sep 2021 01:38:36 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: b8b03ebd-a01e-009d-276a-decaf7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
cf-ray: 7793e143bf3a5a85-MEL
expires: Thu, 15 Dec 2022 03:33:46 GMT

GET
H2 200 660613254010921 Show response
connect.facebook.net/signals/config/ 25 KB
7 KB 537ms
536ms Script
application/x-javascript 157.240.235.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/660613254010921?v=2.9.89&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.235.1 Singapore, Singapore, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-04-sin6.fbcdn.net

Software

Resource Hash

37a00d243c3bc4c5a4a1e4fde67251f06cf484ee2275e663bc23e618560cc091

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 14 Dec 2022 03:33:46 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: IQD5IO07/sBkYSTk1wSmGB2N2fCJTegqMmtX4Ruh0bMvpdCRs/0IeLcrq/9Xke1rLJvEIQ6W7Azobgk425v/uA==
x-fb-trip-id: 548340344
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 WKE6MKSUNNB7PHMNEK4DGH Show response
d.adroll.com/consent/check/ 466 B
953 B 514ms
170ms Script
application/javascript 18.136.172.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/WKE6MKSUNNB7PHMNEK4DGH?pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&_s=a2c7ec121520cb5b7621210667c8ebbc&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.136.172.50 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-136-172-50.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: 58d4f943d20b4f22846e5473d773ca933107792111c7c5e9d9452ab33aacf818

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-type: application/javascript
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:46 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.22.0
content-length: 466
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

POST
H2 202 event Show response
a.bpcdn.co/api/ 2 B
303 B 934ms
350ms XHR
text/plain 34.224.142.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://a.bpcdn.co/api/event

Requested by

Host: a.bpcdn.co
URL: https://a.bpcdn.co/js/script.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.142.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-224-142-149.compute-1.amazonaws.com

Software

nginx /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 14 Dec 2022 03:33:47 GMT
referrer-policy: origin
x-content-type-options: nosniff
server: nginx
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 2
x-xss-protection: 1; mode=block
x-request-id: FzCLfCbF4Jja_MwA9LXj

GET
H2 200 pubads_impl_2022120501.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
129 KB 519ms
217ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 12 Dec 2022 16:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126408
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131905
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 09:36:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 12 Dec 2023 16:26:58 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 96 B
95 B 644ms
217ms XHR
application/json 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=forums.babypips.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

8d1cb9e6a95f358c8bb66afc6b7784822275c5cf07eeaf1833de1aced180a362

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:46 GMT

GET
H/1.1 200
OK 11772829-1659.js Show response
biddr.brealtime.com/ 290 KB
89 KB 340ms
114ms Script
text/javascript 104.17.120.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://biddr.brealtime.com/11772829-1659.js
Requested by: Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/application-02eb5b01b1a1cf955f8e99effc74ea1a09d2012cec1f364a9909c31e66271803.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.17.120.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7561b102c910bcd1c523ab9d7f44a2a9a8dfd2386f14a14df74153b0084d464c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Wed, 14 Dec 2022 03:33:46 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
x-amz-request-id: PANGDB2G54V1H0SG
Age: 4478
Transfer-Encoding: chunked
Connection: keep-alive
x-amz-id-2: /mZX9DYjIxkB0lIBaeRRvr7sheqdsp4kM/GSs2p0UC3ifakKe/P3tIZ7wzPSRsawB4cNF2jAptA=
Last-Modified: Mon, 05 Sep 2022 15:45:09 GMT
Server: cloudflare
ETag: W/"47dffa0ad935417968d4b096edc594a8"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=60
CF-RAY: 7793e1469ba85a6d-MEL
Expires: Wed, 14 Dec 2022 03:34:46 GMT

POST
H2 202 events
a.babypips.com/ 0
567 B 699ms
699ms Ping
text/plain 13.33.88.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a.babypips.com/events

Requested by

Host: a.babypips.com
URL: https://a.babypips.com/bpa.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.88.57 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-88-57.sin2.r.cloudfront.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains; preload; always;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 14 Dec 2022 03:33:47 GMT
strict-transport-security: max-age=315360000; includeSubDomains; preload; always;
x-content-type-options: nosniff
via: 1.1 9725312341802185c9ebf086bf95544e.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-P2
vary: Origin
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
access-control-allow-origin: https://forums.babypips.com
content-length: 0
x-xss-protection: 1; mode=block
x-amz-cf-id: swGqSjkM8kxpsFWJoJLwG3wMNkErarfp7BZUWs_uVmICztPro-pngA==

GET
H/1.1

200
OK

AGSJGGLE2VH5BN4ZL4GWYO.js Show response
s.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/
Redirect Chain

https://d.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%...
https://s.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/AGSJGGLE2VH5BN4ZL4GWYO.js

5 KB
2 KB

223ms
222ms

Script
text/javascript

65.9.164.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/AGSJGGLE2VH5BN4ZL4GWYO.js
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 65.9.164.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-164-14.bkk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa81d2df0436023d86d568a990152fb14be403b804d1856118ea29a13ba58a10

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

X-Amz-Version-Id: umGZzWSLEafLWcND4yrf6QTKU1X.KX.u
Content-Encoding: gzip
Via: 1.1 22e925143a5372744f821dd8419c8b6c.cloudfront.net (CloudFront)
Date: Wed, 14 Dec 2022 02:50:17 GMT
Age: 2610
X-Amz-Cf-Pop: BKK50-C1
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 30 Sep 2022 06:01:59 GMT
Server: AmazonS3
Etag: W/"355bbcedcfcd30d8857ece5eac425d48"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: MKvbJx1AI6223Hl9sdEopcTGrDCireYbOQSv4QS4Nccf6VLtAj3sZA==

Redirect headers

date: Wed, 14 Dec 2022 03:33:46 GMT
x-segment-display-name: Visitors to Unsegmented Pages
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
x-rule-type: p
content-length: 0
pragma: no-cache
x-conversion-value: 0.00
server: nginx/1.22.0
x-rule: *
x-segment-eid: AGSJGGLE2VH5BN4ZL4GWYO
location: https://s.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC/AGSJGGLE2VH5BN4ZL4GWYO.js
cache-control: no-store, no-cache, must-revalidate
x-pixel-eid: QCPUQFKXDZCSJBCXUJZ6CC
x-segment-name: *
x-advertisable-eid: WKE6MKSUNNB7PHMNEK4DGH
x-conversion-currency

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 512ms
170ms Image
text/plain 157.240.235.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=660613254010921&ev=PageView&dl=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&rl=&if=false&ts=1670988826749&sw=1600&sh=1200&v=2.9.89&r=stable&ec=0&o=28&fbp=fb.1.1670988826748.1271139000&it=1670988826194&coo=false&exp=a0&rqm=GET

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.235.35 Singapore, Singapore, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-04-sin6.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 14 Dec 2022 03:33:47 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/66086/ 147 B
322 B 1114ms
348ms XHR
application/json 52.49.107.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/66086/visit-data?sv=6
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.e446dd48ad4c173d0779.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.107.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-49-107-217.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 281d704874a4f296b2e6ec2fcd9464321440a876204662f267df4b0347aff7ca

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Wed, 14 Dec 2022 03:33:47 GMT
content-encoding: br
vary: Accept-Encoding
access-control-max-age: 86400
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK check.js Show response
biddr.brealtime.com/ Frame 6B0E 641 B
936 B 595ms
594ms Script
application/javascript 104.17.120.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://biddr.brealtime.com/check.js?nnn=1670988826880
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.17.120.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cacbe8d075be5b96af1d81fa4753efcb5fdf25ae5acfbf8b6fe16fba1197eace

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Wed, 14 Dec 2022 03:33:47 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Tue, 11 Feb 2020 20:09:04 GMT
Server: cloudflare
x-amz-request-id: H5PXSA6Z3RMMQVSZ
ETag: W/"81b479edefd671af66d52c0ad9347d68"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
Connection: keep-alive
CF-RAY: 7793e1484e905a6d-MEL
x-amz-id-2: dh+VgBn9XWqfeAhwxk91ImbYLiR3oXxMDXM9+D++XemL9y6fob1vJqlGTtUe+souF4qg3FRnSWQ=
Expires: Wed, 14 Dec 2022 04:33:47 GMT

GET
H/1.1 200
OK sendrolling.js Show response
s.adroll.com/j/ 8 KB
3 KB 195ms
195ms Script
application/javascript 65.9.164.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/sendrolling.js
Requested by: Host: d.adroll.com
URL: https://d.adroll.com/pixel/WKE6MKSUNNB7PHMNEK4DGH/QCPUQFKXDZCSJBCXUJZ6CC?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&cookie=&adroll_s_ref=&keyw=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.164.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-164-14.bkk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0e5cf82e4a17e79c80c6f17c3fff873756de944e1301fa01c1d03aba1e359669

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

X-Amz-Version-Id: wG3UJevK_dyyBSOJeVU2_V1xC3jx_aLw
Content-Encoding: gzip
Via: 1.1 22e925143a5372744f821dd8419c8b6c.cloudfront.net (CloudFront)
Date: Wed, 14 Dec 2022 03:01:14 GMT
Age: 1953
X-Amz-Cf-Pop: BKK50-C1
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Thu, 30 Jun 2022 21:48:50 GMT
Server: AmazonS3
Etag: W/"9f2aa6ae991d93164d9512029d813cad"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: H6nNLpc8Pzk2xXvjwW4HSP6wzIxJW0XZTt4PDSHD8djJthmlZXb-PQ==

GET
H3 200 594371247355805 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 628ms
628ms Script
application/x-javascript 157.240.235.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/594371247355805?v=2.9.89&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.235.1 Singapore, Singapore, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-04-sin6.fbcdn.net

Software

Resource Hash

2614518f6510f0c9c4a6f45070a0e62c953d493dda37d25f3989854cf3815f56

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 14 Dec 2022 03:33:47 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: PJPl3JF6qYw6qAiMjckmBuwUHE2ydQoCNHpE1tkrlyuqKi15PORNi/ci/JCVXNmFHG3CyIFPJDStnsJs+rrYkg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://x.bidswitch.net/sync?dsp_id=44&user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI

43 B
510 B

221ms
221ms

Image
image/gif

35.213.12.39
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 35.213.12.39 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 39.12.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Wed, 14 Dec 2022 03:33:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
Date: Wed, 14 Dec 2022 03:33:47 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w&google_tc=
https://d.adroll.com/cm/g/in

42 B
554 B

170ms
169ms

Image
image/gif

18.136.172.50
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 18.136.172.50 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-136-172-50.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:48 GMT
server: nginx/1.22.0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://d.adroll.com/cm/g/in
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adv...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expiration=1702524827
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expiration=1702524827&C=1

43 B
766 B

296ms
296ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expiration=1702524827&C=1
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=105&external_user_id=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expiration=1702524827&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3

200

458249.gif
idsync.rlcdn.com/
Redirect Chain

https://d.adroll.com/cm/l/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://idsync.rlcdn.com/377928.gif?partner_uid=b92ddb082f0564889915d9789bf0a6db
https://idsync.rlcdn.com/1000.gif?memo=CMiIFxIrCicIARDqIhogYjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGIQABoNCJuI5ZwGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=8a747742a949c78d9f39221347d112a85c52e30f9a1389a1f797cfb7b7811ac1791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA4YTc0Nzc0MmE5NDljNzhkOWYzOTIyMTM0N2QxMTJhODVjNTJlMzBmOWExMzg5YTFmNzk3Y2ZiN2I3ODExYWMxNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4YTc0Nzc0MmE5NDljNzhkOWYzOTIyMTM0N2QxMTJhODVjNTJlMzBmOWExMzg5YTFmNzk3Y2ZiN2I3ODExYWMxNzkxNDI2YjU0MTdkY2UyMRAAGgwInIjlnAYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=66534dcf-f24e-42f6-b3ab-5b2558d1ebbb

42 B
60 B

276ms
276ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=66534dcf-f24e-42f6-b3ab-5b2558d1ebbb
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=66534dcf-f24e-42f6-b3ab-5b2558d1ebbb
date: Wed, 14 Dec 2022 03:33:49 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expires=365

42 B
799 B

686ms
172ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expires=365
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&expires=365
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:47 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.22.0
content-length: 124
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H3

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://us-u.openx.net/w/1.0/sd?id=537103138&val=b92ddb082f0564889915d9789bf0a6db&gdpr=0&gdpr_consent=
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=b92ddb082f0564889915d9789bf0a6db&gdpr=0&gdpr_consent=

43 B
61 B

261ms
173ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=b92ddb082f0564889915d9789bf0a6db&gdpr=0&gdpr_consent=
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:47 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=b92ddb082f0564889915d9789bf0a6db&gdpr=0&gdpr_consent=
date: Wed, 14 Dec 2022 03:33:47 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&...
https://sync.outbrain.com/cookie-sync?p=adroll&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=

0
308 B

975ms
245ms

Image
text/plain

66.225.223.159
NTTA-3946

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=adroll&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 66.225.223.159 Sacramento, United States, ASN3949 (NTTA-3946, US),
Reverse DNS: sa.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Wed, 14 Dec 2022 03:33:48 GMT
Cache-Control: no-cache
X-TraceId: d6a2d67cb863186704173195d680a79a
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:47 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.22.0
content-length: 121
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXy...

42 B
494 B

516ms
170ms

Image
image/gif

67.199.150.86
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 14 Dec 2022 03:33:46 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:47 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.22.0
content-length: 212
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

0
312 B

174ms
174ms

Image
text/plain

52.74.162.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Server

52.74.162.2 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-74-162-2.ap-southeast-1.compute.amazonaws.com

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:48 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
date: Wed, 14 Dec 2022 03:33:47 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&a...
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI

0
223 B

522ms
170ms

Image
text/plain

141.226.229.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 141.226.229.48 , Singapore, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:47 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 168951

Redirect headers

location: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:47 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.22.0
content-length: 111
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://d.adroll.com/cm/triplelift/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F42205...
https://eb2.3lift.com/xuid?mid=4714&xuid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&dongle=c85e
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=

37 B
354 B

194ms
193ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-type: image/gif
date: Wed, 14 Dec 2022 03:33:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=4714&xuid=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
date: Wed, 14 Dec 2022 03:33:47 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://ib.adnxs.com/setuid?entity=172&code=YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DYjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI

43 B
1 KB

228ms
228ms

Image
image/gif

104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DYjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

HTTP/1.1

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:48 GMT
AN-X-Request-Uuid: 93ebabc0-712b-42e3-940d-f40f1b444c50
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.209.254.5; 103.209.254.5; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:48 GMT
AN-X-Request-Uuid: d0ae506a-c3c9-48f0-92b8-ff3ade1aca76
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DYjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.5; 103.209.254.5; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=55e6915fab8ccda84cbf13c747d98249-1670988826735&pv=81783768249.42038&arrfrr=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&adverti...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=uS3bCC8FZIiZFdl4m_Cm2w&google_tc=
https://d.adroll.com/cm/g/in

42 B
554 B

170ms
169ms

Image
image/gif

18.136.172.50
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 18.136.172.50 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-136-172-50.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:48 GMT
server: nginx/1.22.0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://d.adroll.com/cm/g/in
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
713 B 688ms
229ms XHR
application/json 104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:47 GMT
AN-X-Request-Uuid: 0faaf828-6cb9-42f3-a1df-42f75a56da1d
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://forums.babypips.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.209.254.5; 103.209.254.5; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 arj Show response
okodigital-d.openx.net/w/1.0/ 174 B
594 B 511ms
287ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://okodigital-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=971299fa-a708-4bba-8b23-c898d13ee817%2Cb7c118e7-6ec2-4089-a6df-624ef9ab2923%2C46b4afcf-b945-42ec-90a8-c3a17989fedf&nocache=1670988827347&aus=970x90%7C728x90%2C300x250%2C970x90%7C300x250&divids=%252F4062275%252FBP3_Top_Billboard%2C%252F4062275%252FBP3_Bottom_Billboard%2C%252F4062275%252FBP3_Med-Rect-Sdbr&aucs=%2C%2C&auid=543876316%2C543876358%2C543876365
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: b1b2fda864f9dd8776a22d86fd0908027229fb9d3d2bf92fc65ebd406864a530

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:47 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://forums.babypips.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
530 B 747ms
251ms XHR
application/json 209.191.163.209
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_6.27.0
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.209 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 161df7c3f2c88ecdb80b0c33f8504645d59479e377b1344c48dc4a5eaca8d5f8

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 14 Dec 2022 03:33:47 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://forums.babypips.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
567 B 805ms
249ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17974&site_id=359886&zone_id=1949918&size_id=55&rf=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&tk_flint=pbjs_lite_v6.27.0&x_source.tid=971299fa-a708-4bba-8b23-c898d13ee817&l_pb_bid_id=16e8a977668024d&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5581522293032055
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a1b03bb67724072d194ea166488218bdb2df55dc6ab4fa82690e5d492281125d

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:48 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://forums.babypips.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 241
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 259 B
817 B 802ms
246ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17974&site_id=359886&zone_id=1949918&size_id=15&alt_size_ids=2%2C55&rf=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&tk_flint=pbjs_lite_v6.27.0&x_source.tid=b7c118e7-6ec2-4089-a6df-624ef9ab2923&l_pb_bid_id=170fe3ad2f4ab77&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5776769118469034
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: ad70578bc27f78725d2e11ab5de508e98cb8b8c4e82806bca17476037ce5e479

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:48 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://forums.babypips.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 259
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 237 B
564 B 822ms
267ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17974&site_id=359886&zone_id=1949918&size_id=15&rf=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&tk_flint=pbjs_lite_v6.27.0&x_source.tid=46b4afcf-b945-42ec-90a8-c3a17989fedf&l_pb_bid_id=18c7302e40f50f5&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9461591165577918
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f44b3d75be2054aaaf255b3c930725313e036156789ecaa047d011cbdd04ff2a

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:48 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://forums.babypips.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 237
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 486 B
827 B 982ms
394ms XHR
application/json 145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 86869d87c0f591e8832857992e875ebe1e80a362c03fb6217a07b37a8f1d4afa

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 14 Dec 2022 03:33:47 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://forums.babypips.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 106
content-length: 260

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
565 B 387ms
206ms XHR
application/json 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=565005&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2223ad15c4e02f21a%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%226.27.0%22%2C%22userIds%22%3A%5B%5D%2C%22url%22%3A%22https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2224ae662e2b4175f%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22565005%22%2C%22sid%22%3A%22970x90%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%22257b82d2f1e2735%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22565005%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22565005%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22565005%22%2C%22sid%22%3A%22970x90%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2228f863d614c5094%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22565005%22%2C%22sid%22%3A%22300x250%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%7D
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6116464783e1c2b012f1f15212ed5a6f1dc1dee369b3636ef2831e34a59bf553

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3sOb1%2BqJRi%2BoeJAODK1zHuQkmpooAY0ko4tsTKe9nHsJITtWtKBc4iVBLJpi0Mfuh2A1CDefTUHKwrfs7fnOOdiU%2BgUuLKf1hJ4p7qmhlvBkYRBaoOnjBN9dBOLp8aFNnfeDXkel"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://forums.babypips.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7793e14c6d145a67-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 / Show response
e1.emxdgt.com/sync/ Frame 6B0E 0
67 B 879ms
291ms Script
text/plain 35.172.34.118
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://e1.emxdgt.com/sync/
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/check.js?nnn=1670988826880
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.34.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-34-118.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:48 GMT
server: awselb/2.0
content-length: 0
content-type: text/plain; charset=utf-8

GET
H3 200 /
www.facebook.com/tr/ 0
18 B 349ms
175ms Image
text/plain 157.240.235.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=594371247355805&ev=PageView&dl=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&rl=&if=false&ts=1670988828122&cd[segment_eid]=AGSJGGLE2VH5BN4ZL4GWYO&sw=1600&sh=1200&v=2.9.89&r=stable&ec=0&o=29&fbp=fb.1.1670988826748.1271139000&it=1670988826194&coo=false&dpo=LDU&dpoco=0&dpost=0&exp=a1&rqm=GET

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.235.35 Singapore, Singapore, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-04-sin6.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 14 Dec 2022 03:33:48 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
792 B 684ms
225ms Script
application/javascript 142.250.4.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=forums.babypips.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f156.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 667ms
222ms Script
application/javascript 142.250.4.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=forums.babypips.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f157.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 278 KB
70 KB 672ms
671ms XHR
text/plain 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3242375731416201&correlator=1495862089281497&eid=31070873%2C31071150&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=4062275%2CBP3_Top_Billboard%2CBP3_Med-Rect-Sdbr%2CBP3_Sponsor%2CBP3_Half_page%2CBP3_Bottom_Billboard&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=970x90%7C970x66%7C728x90%2C300x250%2C300x50%2C300x50%2C300x50%2C300x50%2C300x600%7C300x250%2C970x90%7C970x66%7C728x90&ifi=1&adks=1278928230%2C3560482578%2C1011207388%2C1011207389%2C1011207362%2C1011207363%2C1514395016%2C4189699036&sfv=1-0-40&prev_scp=%7C%7Cposition%3D1%7Cposition%3D2%7Cposition%3D3%7Cposition%3D4%7C%7C&eri=1&cust_params=page%3Dforums%26trust_level%3Dundefined&sc=1&cookie_enabled=1&abxe=1&dt=1670988828361&lmt=1670988828&dlt=1670988823438&idt=3886&adxs=315%2C1084%2C1084%2C1084%2C1084%2C1084%2C1084%2C315&adys=145%2C453%2C808%2C868%2C928%2C988%2C1088%2C3682&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C0%7C0%7C0%7C1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&frm=20&vis=1&psz=1600x126%7C330x280%7C300x50%7C300x50%7C300x50%7C300x50%7C330x280%7C1600x66&msz=1600x66%7C300x250%7C300x50%7C300x50%7C300x50%7C300x50%7C300x250%7C1600x66&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&ga_vid=729902634.1670988826&ga_sid=1670988828&ga_hid=1777195376&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

4ff176535630bc6ef4bbec05a418f74a41ba92b482f111bedbff9c9bea5b403e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 71516
x-xss-protection: 0
google-lineitem-id: 6113532950,6112746136,6103523738,5637673636,6129736051,-2,6056145724,6056960858
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138416068003,138415450244,138403284069,138371854060,138400137125,-2,138361826439,138307683905
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forums.babypips.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A09D 6 KB
3 KB 657ms
215ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Dec 2022 03:33:48 GMT
expires: Thu, 14 Dec 2023 03:33:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C475 0
0 259ms
258ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuVemkUY0QIy0kwl7vvUlSfk81vfkczLwn_qhBYbtlgVSTNbEoK4mu_16r-BRUgEKVt67dw-OD0VWwKGoN6vl3DVfs31cyQ0vqUfmuX_fEg9bA-mDkWLoJq7LTVY_fFjmljClGP7Q449uqRN-mYQ1NGSAXOYibO-kMKpGQ1Z5rVRX-hjZafPDqdcDaVryjkbjHVgaQSKAZQUk-GK5ZEKqXZcUxAhciQbNf5o5iPel45cNQvSURzMT1YxdnDxFj-hjTA5sGwl8zuqfnovaJI3YLfXbcgRrSBFNxbj_mfC2nZDKLYe9zTQ7HLjX0tzXbvSRWfxsS0qjlDZBw&sai=AMfl-YQmOlDmIrpk7gvs2t4AN45D1R3QlWkUjaV09qxqMYIlt8KxYOiAxDVUg-aFVgjbR_tQBTRFlLB0wEkCVcxm4BtjuwZXQ_Ye3B4heIBA8dk9EGCYkML75mXs0kh5NvP2&sig=Cg0ArKJSzPyh4stY22LdEAE&uach_m=[UACH]&adurl=

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame C475 3 KB
1 KB 662ms
223ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 21:35:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21488
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Dec 2022 21:35:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C475 153 KB
47 KB 219ms
217ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:49 GMT

GET
H2 200 14509404104759668344
tpc.googlesyndication.com/simgad/ Frame C475 52 KB
52 KB 696ms
257ms Image
image/png 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14509404104759668344

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

ca206df6779f9d8cdc7e9abf119c4ed1af8b05238501a21442cc844e36aa56c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52880
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 17:14:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 14 Dec 2023 03:33:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C475 0
0 708ms
264ms Image
text/html 142.250.4.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSIMt5vBxXvnqMrnp5I6xEHbO3anGMovBfqqIwdPZfCIQb7-lF9ogZjlBCLroFdj346khm70KeLIBb8mv6HzoCk4dz_Tw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.4.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8691 0
0 218ms
217ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss0iZWsIoiFjvUPkYMR_mHgqOwCQpvB_8wjqNrIPBjUIWDbgKLRoM0vxHzSF5Yu6oB_7r1V8REpOssqBdGNzds4q8lhbOtRLTx5dXKDLY17aCKpFDZfCLRDcLBkbQ5mHCVIv-hBLVZxXgoZbgBfpIzmrqpyloKAVu_UghaRb0tRU7tADm725FaiwFyXaPAzejQVOli29z6yKFuU1gmusjaOzHl5iwj1xnnQUMEC9NIafqjI346JScmNgnj51mXRgIfIBEqdj3jgCvXjsn45Pm9ODrSL3_MCYV5YgxUDTLW9ece3sCS-XTtjvJ2F3pJxSKsDiu50rhdNdxo&sai=AMfl-YTChsm1UtjkJ47EkMCbuM0YO5A9AHSuvN_lGTw4Dyk3WaYfaKq53dtGnSeJonA86cBDU5p4JehoKNUxqV5KDkrPbGrZZi7nX2RMyl63xMhYyR3mebbdrmaY2j-47ADl&sig=Cg0ArKJSzM0I8P9TJ8eHEAE&uach_m=[UACH]&adurl=

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 8691 3 KB
2 KB 647ms
217ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 21:35:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21488
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Dec 2022 21:35:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8691 153 KB
47 KB 494ms
494ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:49 GMT

GET
H2 200 10672226491145006806
tpc.googlesyndication.com/simgad/ Frame 8691 36 KB
36 KB 1036ms
607ms Image
image/png 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10672226491145006806

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

9cc3372111d4e963830b30756f06195b4c1d1fd3b5ef817351451b8dbe2f9ccb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36782
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 17:06:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 14 Dec 2023 03:33:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8691 0
0 698ms
263ms Image
text/html 142.250.4.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSgqMWf1oS3js3-bHiSLVTsNO5-Sq4iT4Qb5zaFF8udY5jApJ6pkp5vuzFzwV-EpeZtlvoqRZscFif0bY2J8-UI7PJoqw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.4.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H2 200 container.html Show response
2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E89E 6 KB
3 KB 516ms
215ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Dec 2022 03:33:48 GMT
expires: Thu, 14 Dec 2023 03:33:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8AD8 0
0 218ms
217ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss_Ddxmyl9puXPUFnTnKi6qp_RKH5sdiayHcQp0M2Ovw6XyyHwJCvbUSnxwB7Yw8CJU4QIfwQDMbqVU9nj32cxVfrS0SVgdb-WRw4-DVQb5JPx-WEBfnUNDcv80V2Rvhw3QC8WF1dnAalRviBwxEJs2ACpgwwpwLFx2Zx1HChOo4XINIgMCdDYdex5xRGCAdBnaQ5QO5M9bLK8HTE1lNBxoCrNpp0f5BY0IC_iUS_P-8_NvZ9uChtkRLWf3M7wycRH2hkw7a2Y5aRjV3-cWQ68WvGloO9dpwCCHIhzORVWyaaLpNAZX3MF4IkLE6OJJCaU&sai=AMfl-YSASMWFYUDTxKpba1E-oLFN3WI7RKyF5wRROXuLFrQILtjnFkgWF8Wd3K2kxceXUtGjiMmqQLNOVEk4DLAB9-NfmR_3ghrIWOGasyrp0BuFKxbP70zisF7e-ZFj5MWX&sig=Cg0ArKJSzDZ88gk0OdEiEAE&uach_m=[UACH]&adurl=

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 8AD8 3 KB
1 KB 630ms
218ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 21:35:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21488
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Dec 2022 21:35:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8AD8 153 KB
47 KB 659ms
658ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:49 GMT

GET
H2 200 16167540886394757359
tpc.googlesyndication.com/simgad/ Frame 8AD8 3 KB
4 KB 653ms
243ms Image
image/png 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16167540886394757359

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

b268ea27ad3a3239dbdbbd21130bd8ec516d60d5d524b28c3e9b0b60270cc960

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3283
x-xss-protection: 0
last-modified: Mon, 15 Nov 2021 16:33:57 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 14 Dec 2023 03:33:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8AD8 0
0 684ms
267ms Image
text/html 142.250.4.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTh39C9SJEy_rqQUyTBL8OH7r5F00tmTh55mihi7_Ccg7D5AdvAzZ6tFowmGJHZZXaa2iM8pDBFQt5ct0J0E6Wp5g1I-A
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.4.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame C475 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9f912c9f70335bc95d42c64646ed80292faefff4d6eda1ac6bebc822e8c82803

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8691 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b26d6da6f6f143147c8b3b0c3ba439290c409c6e17929bce9278906714d5b18f

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8AD8 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0fabda398642f3b3ff7a4f9a23c02c21cfe79e612571efa4cdfebe88cd8ace0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A40A 0
0 653ms
219ms Fetch
image/gif 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv6bhAvw4R14_bgW9YZnGSmrrFfihN14ZZcT0nxTbXLUOkiuRMayCvcc4MHgU67RkspfHKb4_LC593JhrtnKV__SjUcY5R2RvAuOGHUHKNzaUw2sp_4FpvvTsH1Q2Gq44y-2DldDqoGneRGmGB9sogNZnH5t5awvrffZjk32pZr1uWF0U_P_ch3Uyv8KRigCD2QGRsdbU3BhCVmQrbhpduFjzqay1DsEpZ_ML5yemAyLijzKiA3iaxrs-ISGEb7fqrSMr5oDBWXUAFCessYoaALjvvCnVZFUY58hwXlNK77L-sFhj-IN-TCx8Qg6qyLUewKAJ0T7-0IyMa6dJVPNXQkUq1yTirh9LjjJ3qWwL8LTYhtMg5I6oM2A040ThIpySyVamZ6yiSjQbTHr-xpLdsprJVF10oeE2g&sai=AMfl-YQDC8JHk7d9gKoz1pwSqWHX1tgBISNyH0YmjdsUVZI9fbf_we9Z5gEh4tXnfmsljUSBilPpWY3Z_cymyFuM_9YwC8KgadhNEZISefPHcq8WIQEl95xcR82v9aDxrJcU&sig=Cg0ArKJSzDzp1QjG8VAiEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/ Frame A40A 6 KB
3 KB 676ms
224ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

c0f9a96a8b15dfa0bd82a9b0c4f7d31927c96784bb62af0a94fbaa78cde5e2fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 22:21:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2477
x-xss-protection: 0
server: cafe
etag: 8436122973860808490
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Dec 2022 22:21:04 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A40A 41 KB
15 KB 669ms
668ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 14:19:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393273
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 14:19:16 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A40A 153 KB
47 KB 693ms
692ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:49 GMT

GET
H2 200 8736041586169534673
s0.2mdn.net/simgad/ Frame A40A 15 KB
16 KB 649ms
216ms Image
image/gif 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8736041586169534673

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

7d875213b4c7f08845d0e368d80a9ad3725f554034e27b13554ddf2a9a5199ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sun, 11 Dec 2022 15:47:47 GMT
x-content-type-options: nosniff
age: 215162
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15729
x-xss-protection: 0
last-modified: Fri, 13 Aug 2021 11:59:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Dec 2023 15:47:47 GMT

GET
H2 400 img;adv=11147208041415;ec=11147225831950;adv.a=8029426;c.a=23292337;s.a=5695026;p.a=256871051;a.a=453082171;cache=2688146527;
ad.atdmt.com/i/ Frame A40A 0
0 709ms
355ms Image
text/html 157.240.15.14
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.atdmt.com/i/img;adv=11147208041415;ec=11147225831950;adv.a=8029426;c.a=23292337;s.a=5695026;p.a=256871051;a.a=453082171;cache=2688146527;
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.15.14 Singapore, Singapore, ASN32934 (FACEBOOK, US),
Reverse DNS: edge-atlas-shv-03-sin6.facebook.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 026C 0
0 534ms
220ms Fetch
image/gif 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsubJ_zGkI9efAUkZJhf31ZZqvZyY2hSJFUcLsiwc9aOsvAQ752KrTWT444N_Ty_wgo-8yWkAToBwtBHqpu9in9nYH7T4ADrS1vAngAnaZ-1iDaiDJni_EsAd_BjzUFALWIGtftGRgj1s2kvQkapXGdEJAj9zrr8MCjiu43F9taAQ-NZqeXb2GDX2oSY50ZtdFkDqhD-28kX0CHozoIQzMLConGj92hatXkQ8YIBi17l59_pDaft8mQqSjPrqyNhwNbLmcXvhycdJ3PslVktZJT4dd-YjEUzVIuobIGL_BNExRnYPbL7t6rrGjAwkCIjUCzPAHOS0gofvIN3CQfC3S1Qc6KqgsY5tGIvTqtq5LDpSdurECPpCwJ3sYCsty1DmmpNw15c9Vxosz5khUw91kbKS6Kc5PIaGrJ7w0MGKGY&sai=AMfl-YQrH9Veo9erk870x4Km9e9AXfM2mTKZkt-w0yE_nwlWi3lADYANxMrdTJDJHYSX0ZGUcu8uyxNdn2EtCkc5EzuEfWpYucTWKa_ChZISnK9EP_4xiXy-sS-gu2MH_0GB&sig=Cg0ArKJSzL3rYgg8wDo_EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 026C 106 KB
38 KB 678ms
226ms Script
text/javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Origin: https://forums.babypips.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 05:09:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80648
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Dec 2022 05:09:41 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 026C 41 KB
15 KB 711ms
711ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 14:19:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393273
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 14:19:16 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 026C 153 KB
47 KB 671ms
369ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:49 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 666B 0
0 517ms
220ms Fetch
image/gif 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvFgctDNHnlFqKG9Z9L-4Yha8poY-UbtGckoWWNRPIkNUSyIQOS-8zDLx3lO_XP5N5NfTzeFXHDMtY0DU9IHpDk-gMJN9rcLSvD7gcMWQkSAGhH8zwKfUrODIo2uGUQWu_nR-8RMEjgY2YhzbeEV9zKUHPD77C739Bk2tI3R41mJq5W8bTwSyciZ040nq79jzXfvsgpoo6ocoPEvOzAVLBK6SVbkZTb2NofYRH8srBvp2GwSz9P_2SAnTpq5kHDAUzhuT8S64PvT8ya02_h7R6nsn9AuMPWDZyBpkFN4mjQL7NFqsPbccJKDpJ2Dj1eBYg3EvlgSl-T25TzZU4Pqmrbyz-GFbgZYia-oReDQhKKZ-56WBj6kKKDUpR0ETHv-gau0tE9ycftAcPDdF7fq1gAGtqWaaM9kgeuG1GZizLExpiqU_w&sai=AMfl-YT-Y6mEKgG3X6Aqc5QcuBFWBrA3fr3B-4HBkz2oTR3hXIIn_7Zjss_Qua-IdXvzoVwElCESsi0EBsHRV5T4gvHRHhg-VSs_eh0hoLtWQIOn9qhCfgqRV7yOVK8Q7ali&sig=Cg0ArKJSzK71ShPsMXO0EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 666B 106 KB
37 KB 947ms
512ms Script
text/javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Origin: https://forums.babypips.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 05:09:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80648
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Dec 2022 05:09:41 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 666B 41 KB
15 KB 753ms
752ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 14:19:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393273
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 14:19:16 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 666B 153 KB
47 KB 719ms
418ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:49 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame E89E 24 KB
7 KB 745ms
745ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com
URL: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56695
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 13 Dec 2023 11:48:54 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E89E 153 KB
47 KB 314ms
216ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com
URL: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f155.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:49 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8AD8 0
0 262ms
262ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstSAV-XipX3KB2HViU-hp95SmIb_cwgcpuRSJeK9--HeIHSOYkqnHbJ5PznaLiE0v1p6lav4OO7DCzCvcYDhUOdgFX4Pbp3-WAO1hAQEI9DnKw6ABSuawzakAsf8ZFbyHfQiTWnpc_5vDyK8JJnZ7FfsUp1_7RDVoRVgJk-aAozkUTFejDtTlJk6va6JOQBrca-4Efurhwhqu96gyFu07hsyRauqe-ufgtNBE6U8GNck5b_c2PLrKiD25P_CZIfhliKj0vxyZoBF2wi28EOKuztdgHmhvNxUTg7N6FpNuZ6TADaNQ0hK4uTaANlVaBXviupXQ&sai=AMfl-YQxkadwP5lkHAVmw56d0_sy-c_r37gJE6jTBTGUDgb0ydqKoDiCzj5rPrlkB73gM8nx7i97cVOluSmZVYTwQp5VvufSsalWzRCwr3ZJULUgpDDk2mHjuDBG_xbIbha7&sig=Cg0ArKJSzAOm4X0XisQ0EAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:50 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A40A 0
0 219ms
219ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvMYAVwG0zYHlD8M8FUCl2hltY6wPc9o-1_qlT4S_6aG5FE4J-7OldmogdAjZEiy2hG6JStVof_8jFYMPt53jNGuMMlnuWcoh-y-AcSZYnLv5Qj10y_VGiNha8D-AhxpfIV3isg3_w-x2pUKLDciITp0vkRlg_2nDb17LbsDoK2ZcOvY0n64giTyyVRrsntJn0vOf2pFen0pjFA4jQleYPz9ktH7ZtlOZpi8EOWdSmB-_xdvhtMPpWro0qKwHPP71LO5JnLQAqpXj2yg6djuVwxfZdftv2wsBoerCGoqBuDydIh5YHVyslpK5fpSTPrYtseEg&sai=AMfl-YTxPSvqLmurQoSSDZU8oHqXYghDwB1gxJIaGsBuN11yQSeXd5CjYeBqfOjG47GJUaiFKRN_eMqTA3hfVlbhWHGy3sAALEPNx0Bfughz4K1ICj-3XE1AzZNh_CdFosPW&sig=Cg0ArKJSzBqsyNXCyVrQEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:50 GMT

GET
DATA 200
OK truncated
/ Frame A40A 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bec19b651f7faf6084fa089b4464cd567b837c5e2d67131da26a9bcd3cdbc69f

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 026C 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 53e059ab1969d83c65c65590526e96a5fe0c808d4a5ea98ea6169a13f11a5ceb

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 666B 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8f1973d1b29fd7596e579ec13ea05497cde3a54d3bffc31232516833c896ff2

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C475 0
0 266ms
266ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstUZCXF-6Jyi84G3o5iQqE93P-upBO3ILq9Ir7pVUpir0_8V3aSnYXRqDDvj6E_7DhKrvz_12pPzMCHTDWlhEC2NnhOoaFC0MAc3X-gZy-W8snnL-LId57KLZQ9TQzFbLuKpuKgbHLKjslHFfUixt217lOaRTla3ndz9lrVi5CQNQlmZ8OZq5zW6cceFLhr9dEsUu4mvvhEv5yGnzUKyqQiXvwE4pJ3tZ8K8Sc_RBiS0rufHsQjfUxUpx5k6KHovgPt7YH1J0YJXwSXwUKVSb2PvJWz1GSb74ZKPNTUIlCpM-ZEGcItf1EBBG8loPvo0tdTUK4f0H9d_9Jdzw&sai=AMfl-YT9whHzGMRPqcHNQpwAwzhkOmmfBXGAkbd6EXJSvuwkaXlFiPJ5WyBrEbWl5Yqcyo9CF-QLPt3ZLXHWBvdF-LZHp5pHqAjkQ3pPnc9_SyuiLZtKEYvRrS5b1gopaLC9&sig=Cg0ArKJSzBdCKjpt2fWwEAE&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:50 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8691 0
0 261ms
261ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvZoY3hTKdqyv7SRm_A7NZERjiCUWQKn9zc6jzZaFsCuIj5Yq2358qujcIcOkjY6jNIuX05zzKaa4MRy0dMAt18TIoGgezxzS0jPZUGRk4kBynBDANi3_4M_4wiXYzl0wUyva4ia_G81K56QZn3-4SRxHYJch_Zjg_ezn7hepZmukIaO0MM7FtJ2zlSY63JIY1hzNp8l7LHaWsxx3Q5swPl6NaLcGFtYlvAN5_1vCWT_LQq18Pe3CpVRVZ3PuxVRRSt-NjZwUI2OH2gbiL-w-_vQm-P0ea8LQOTyACazV573e_sBNvLKEXgUHKFP8dGtHoYw9E4EU1i9z63VQ&sai=AMfl-YSODxAFxi1GtzsDRwniUXp7Dm-nBpDCF1fQc97_skzuAFxbxyW5uCeFG9gYeQbwMTdBzfpjAQEPFhbnwsLGpvk9bG7hIwb3cgkRpIVXj35beJsGD1LShzVM9mgY0fJz&sig=Cg0ArKJSzGV6QYc8LvkBEAE&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:50 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 65 KB
10 KB 536ms
234ms Document
text/html 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

38d34449d164b7b26815339e2bd9105b0639426bcf2230e33f84630bf409eebe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Dec 2022 03:33:50 GMT
expires: Thu, 14 Dec 2023 03:33:50 GMT
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C348 22 KB
8 KB 519ms
217ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 483981
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 13:07:29 GMT
expires: Fri, 08 Dec 2023 13:07:29 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 41BF 22 KB
8 KB 519ms
217ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 483981
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 13:07:29 GMT
expires: Fri, 08 Dec 2023 13:07:29 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4769 22 KB
8 KB 520ms
217ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 483981
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 13:07:29 GMT
expires: Fri, 08 Dec 2023 13:07:29 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E89E 0
0 263ms
262ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss6FUK_vW2VCDb9v1ip1M2nwVx2ksQZ7aEhhu6KLgzWxwLoN3rBeA9yQp0DnPY6fN_5_wzY-EjgZ4I8MEk0--AHbeccydA7ug-fgmVimJzXNFSZL5s1ntJuUf0UBH64R9FN7ZX3lJ4BJa4MBWeZLdhOPlt8ATwV-SSfZetM444qJ6O-E6lPw3QrVvyj8fo9bljPw1bWtZOxTFR-UxNtuGCxVqX9xzgnbVDL21owOju-OjoZjeiDk69DvN-ciRfaqHh0VoCsj0JoCLk9672HWMghV7atsxZ7AIpV2VJeMufcmDF0OTcPULfk7bwjPtfFA-8&sai=AMfl-YQINA0gpatAKqk-oA1sD2_Xwl300z_q_ivoFN1LWpUegzvB1Ckp_K7AKsXbsGiCSxmtxLJb6BtjtAj0SZRaUulIMAdoOodKkP1vw3SBZqVBDX4Q4d1srjgFvvyhu_N8&sig=Cg0ArKJSzH4GllZNR4GkEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com
URL: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 iframe Show response
c.bannerflow.net/scripts/ Frame BC0F 2 KB
1 KB 284ms
104ms Document
text/html 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Requested by: Host: 2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com
URL: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 977d451e80d86ce0095b2583c1bc564c61fb80b90b6b36a0b940cb114d1f1813

Request headers

Referer: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
age: 84209
cache-control: public,max-age=86400
cf-cache-status: HIT
cf-ray: 7793e15fba663778-MEL
content-encoding: br
content-md5: tLVQ4AWl+s/+JGanOSwyxg==
content-type: text/html
date: Wed, 14 Dec 2022 03:33:50 GMT
last-modified: Mon, 16 May 2022 09:29:29 GMT
server: cloudflare
vary: Accept-Encoding
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: d808c047-801e-000e-1dd7-bec496000000
x-ms-version: 2011-08-18

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E89E 0
0 259ms
258ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvUzAZdW9vNRQuoPPDy35M1OLxs5hriUDl8LpUg1k2dxQHrTkFXK_ZDyiwJYH38Fs8kmug6-u4XkofU7Lkk-mOL-AOPT9xxAObhHsznrUJsU4OaQNOF-uZzB3jFvfnF9JdpNu1S0VMB7FAfnAqCqQhenUfoydUMco5N1nOUkLmyYyM9OTrSd1MGf-K8FvFvI1ve2aT0VIrz8u0oU6QQQ8tuGmA2musiDRtihiPWG02dfDvHvZGQr1VzFLEoJ1GCezVwN1mv-wt9hgCF184SVAorQ9PZ2_OKF_cIZ58qPwl-PwYeDraVq1KJiIG_eU55CG6TMA&sai=AMfl-YS-qFx4_A1M6fvnqlJgSlp8NOK_0akHCEL-qQgfScqumCVCDUjTE2yZGl7ZE6vlKCyqCZVl1Il9BUj_D9w3o_vcSQTKkltIy3KGbyr8afF9H-2-ea4IX95XpV-sDR3o&sig=Cg0ArKJSzG_ddCl3yOZoEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:50 GMT

GET
DATA 200
OK truncated
/ Frame E89E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef910e2edab15a4fcdac975b228dfab8599c429100c0f2d19ed20963defc22da

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 13820216665840291570
s0.2mdn.net/simgad/ Frame 666B 18 KB
18 KB 513ms
224ms Image
image/jpeg 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/13820216665840291570

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

cf140999642cf48bbf8a149b560f33fb8e80fadc2b2d7c0a9248f05f3587ff31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 02:38:33 GMT
x-content-type-options: nosniff
age: 3317
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18193
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 15:12:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 02:38:33 GMT

GET
H2 200 6311b3a9a17d0b5ff3a09ad2 Show response
c.bannerflow.net/a/ Frame BC0F 66 KB
23 KB 225ms
224ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/6311b3a9a17d0b5ff3a09ad2?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61f88a0d9295b799638b491f47c21a640c38547d24cd790024975aae466e56ae

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

request-context: appId=cid-v1:1a5f66bd-0229-467a-a946-b3753e659ecb
date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7793e1606bc23778-MEL
content-type: application/javascript

GET
H3 200 gwdpage_style.css
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 55 B
102 B 237ms
236ms Stylesheet
text/css 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwdpagedeck_style.css
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 731 B
262 B 236ms
233ms Stylesheet
text/css 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwdgooglead_style.css
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 24 B
71 B 239ms
236ms Stylesheet
text/css 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwdimage_style.css
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 281 B
186 B 234ms
231ms Stylesheet
text/css 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwdattached_style.css
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 26 B
73 B 257ms
254ms Stylesheet
text/css 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdattached_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwdtaparea_style.css
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 157 B
143 B 241ms
238ms Stylesheet
text/css 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdtaparea_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.0/ Frame E73C 90 KB
33 KB 674ms
222ms Script
text/javascript 74.125.68.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.8.0/jquery.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f95.1e100.net

Software

sffe /

Resource Hash

8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 07:06:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 592024
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33285
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Dec 2023 07:06:47 GMT

GET
H2 200 fxcmAU-FX-PDS-TMD.js Show response
media.fxcm.com/display/disclaimers/ Frame E73C 417 B
564 B 271ms
85ms Script
application/javascript 151.101.64.208
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://media.fxcm.com/display/disclaimers/fxcmAU-FX-PDS-TMD.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.208 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5fafe19b2bda1f9130c1c632e69783f3c073fd8609893e8cce3645abe89893b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
age: 69895
x-cache: HIT, HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 233
x-served-by: cache-ewr18130-EWR, cache-mel11245-MEL
last-modified: Tue, 13 Dec 2022 08:08:56 LMT
x-timer: S1670988831.104409,VS0,VE0
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 40

GET
H2 200 css
fonts.googleapis.com/ Frame E73C 5 KB
1 KB 682ms
234ms Stylesheet
text/css 74.125.68.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:700,regular

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f95.1e100.net

Software

ESF /

Resource Hash

910612fc65208677f4e2fff60558e0f1949138a3696402a17ed5582efe0d2649

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 14 Dec 2022 02:48:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Dec 2022 03:33:51 GMT

GET
H3 200 googbase_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 400 B
303 B 265ms
262ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 275
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwd_webcomponents_v1_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 20 KB
6 KB 270ms
267ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwd_webcomponents_v1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

9c27626364eeaffb44ad2decb980dace7bedb3c8ea1575f81927fc9409cb5b49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwdpage_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 3 KB
1 KB 258ms
256ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

f3260225ba132e9bf8956514e81f6136265ee05250271a027bb2029cbbf4651d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1308
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 gwdpagedeck_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 8 KB
3 KB 247ms
244ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

4eefdd923f73deeaec9e4ecb4cc3fae74379145f0fd3f5892165326bce8ed0ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3191
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:50 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame E73C 29 KB
10 KB 227ms
225ms Script
text/javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 17:33:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35996
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Dec 2022 17:33:54 GMT

GET
H3 200 gwdgooglead_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 13 KB
4 KB 366ms
363ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

b671e2140966063715d21667867d60de45adc723cd1b31e0d2f7466105a90247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4481
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:51 GMT

GET
H3 200 gwdimage_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 5 KB
2 KB 353ms
350ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdimage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2014
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:51 GMT

GET
H3 200 gwdattached_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 1 KB
618 B 346ms
344ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdattached_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

dd50ba290f74d344ad0d04ade63c55b02360bf4db99c0a2749f34deb0c8dcec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 590
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:51 GMT

GET
H3 200 gwdtexthelper_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 7 KB
3 KB 334ms
332ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdtexthelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

dea5d8ba9e54379b26e109f61ceba20a0781d4f80eed75fce6ad0993d4784195

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2823
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:51 GMT

GET
H3 200 gwdtaparea_min.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 3 KB
1 KB 388ms
386ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdtaparea_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

0f2aac94d011ec45570ef1245e5fc8df73ebd09b1c6859c5a8393df5336e01b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1356
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:51 GMT

GET
H3 200 gwdid.min.1.0.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 3 KB
1 KB 329ms
327ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwdid.min.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

bab745658ba458848b2d2df5e0557b98b70867124fd5a059fd25f9801e01a87c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1125
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:51 GMT

GET
H3 200 gwd-events-support.1.0.js Show response
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 3 KB
976 B 364ms
362ms Script
application/x-javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/gwd-events-support.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

777e5a7ddeca87a0fa0fdaa305ddc1195571e3453413b37bda5d53351cec89e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 948
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:51 GMT

GET
H2 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame C348 36 KB
16 KB 526ms
225ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 21:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23592
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 21:00:39 GMT

GET
H2 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 41BF 36 KB
16 KB 567ms
266ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 21:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23592
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 21:00:39 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8AD8 42 B
64 B 646ms
217ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstdoEnxCwYcl_tM3mdbykAltBF26MGWRnjmKvOilXoe3IY81UZuf5IpzrfrtzOv-J1yCt2IxDPL7bJhkpPQtQNfbHp7QCE_Xo-XO4vKzvMSdBnxVw33&sig=Cg0ArKJSzG7MG_cPhb0YEAE&id=lidar2&mcvt=1011&p=892,1084,942,1384&mtos=1011,1011,1011,1011,1011&tos=1011,0,0,0,0&v=20221207&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=1011207389&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670988829150&rpt=793&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 4769 36 KB
16 KB 670ms
369ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 21:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23592
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 21:00:39 GMT

GET
H2 200 preload.jpg
c.bannerflow.net/accounts/activtrades/5bc9a648f4ea2773b0608f61/published/2932010/3559973/ Frame BC0F 3 KB
3 KB 97ms
96ms Image
image/jpeg 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/activtrades/5bc9a648f4ea2773b0608f61/published/2932010/3559973/preload.jpg
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c529f41df56b85f6205da08846ecf05e3c61b5c9939633d0481ac4e42f212f45

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:51 GMT
cf-cache-status: HIT
age: 5336190
content-length: 3120
x-ms-lease-status: unlocked
cf-bgj: h2pri
last-modified: Thu, 13 Oct 2022 09:05:25 GMT
server: cloudflare
etag: "0x8DAACFA10DB6092"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: c26d5823-001e-003f-7fe4-de2585000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
accept-ranges: bytes
cf-ray: 7793e161fee03778-MEL

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A40A 42 B
64 B 563ms
220ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsub6k4YxvNIHdUS_PUWGp9ixwAh4VHjXhrjPZj_UV_vPQB64qzGr5_M9QmUWXB94Li-Nw2kytezU1r9RK4uUqynhFRK19ada_zrzj7zrGhqPkq-U1TxheJUIUnql77r3-ddvnQOUgZ3JMqwHmcgKJF_VEG7eKQA4zPdUYAeEIOfaGfjVBLHwHdD&sig=Cg0ArKJSzK_xsHaSm3MKEAE&id=lidar2&mcvt=1000&p=952,1084,1002,1384&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1011207362&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670988829222&rpt=821&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 666B 0
0 267ms
266ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssXpvUMTsCtphk189N-2XAPp19qGbNn8l1bCo8Q0IkiPhlPVa4EVQXcjm0h8o4I2F7G6IA8ciaYkRgaO4zubPozcqxwqZbqyrFuNSzGNBvBRvUewGxXiQZtvFFVRke48_vEatDqAduvsjKxDMwI4uyiWLTpSsbowdSCQ3wYQjEya03pePASrstpgzGl6FVONkikZg0IGbtkyCXvFKFbmcsmcxm7Ef5OOFtbv_skzC9hGIxU8LIlmywtGlI14Dzb5zRND_TgqyCXrFbfN7i6p9wIEW6EXiwzj-0C5gotz-9g2KH--I-XLdkdl-2qUsjdcc-z4BhcSXxN0ECjlMbSWw&sai=AMfl-YTGordOQ0Q96Psj8M_cS1AcUUc45_0HXvwbVtP1ucZS44lj_KxDw3i-KdP2V9J7gC1CsWOO7jrWy6eNDH8J4lNAu6YzDm1WP5CBEcHbLA3FI4T33piR_phrZn62DvR3&sig=Cg0ArKJSzApULqs-92MsEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:51 GMT

GET
H3 200 AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html Show response
s0.2mdn.net/sadbundle/1832608659671089152/ Frame 654A 4 KB
1 KB 225ms
224ms Document
text/html 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1832608659671089152/AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

3969298c194b9f5a71031353aba7b3a9d8c684ab97e71ec7bf54cea4834d0fd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 3318
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1428
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Dec 2022 02:38:33 GMT
expires: Thu, 14 Dec 2023 02:38:33 GMT
last-modified: Mon, 05 Dec 2022 15:12:46 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 /
c.bannerflow.net/tr/v2/pixel/ Frame BC0F 0
72 B 189ms
189ms Ping
text/plain 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6311b3a9a17d0b5ff3a09ad2?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7793e162a81d3778-MEL
content-length: 0
request-context: appId=cid-v1:2080cc18-71b2-4e5d-992c-a3d1331a0b3e

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C475 42 B
64 B 433ms
219ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvyEFO7uAHZwhSPuk5tT71uaGr7KKdauBeA8BYo2A9ts4GlOB5ddW3YZDar7O9c7eZZ6EFegVWJiZJlJpNnr6gjc5-V7Ncaib6i2I9jVmBKWUNTvgzQ&sig=Cg0ArKJSzF48wcWt2jGJEAE&id=lidar2&mcvt=1000&p=145,436,235,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=1278928230&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670988829123&rpt=1057&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8691 42 B
64 B 306ms
220ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstnlVe3mix8tBsdb_ABlNIz2lAmU8RNvjvvniL-bv_zJ0vl_Sjflyio3Bmkj1T_libpwRcdd7cdlO51Lu78WjB5Kht73hE-UFQHnHEnYZf18xlEZDCE&sig=Cg0ArKJSzJrXRaIjbONdEAE&id=lidar2&mcvt=1000&p=477,1084,727,1384&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3560482578&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670988829135&rpt=1172&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pd Show response
jp-u.openx.net/w/1.0/ Frame 3C47 533 B
634 B 178ms
175ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: ba2bfffbbf80471e6299cb0b63767ed6094245cda30aef15a9b32d3a37a2926d

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 322
content-type: text/html
date: Wed, 14 Dec 2022 03:33:51 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 isyn Show response
prebid.a-mo.net/ Frame C8EA 2 KB
789 B 288ms
287ms Document
text/html 145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 67f3c6916558e920d3e143f8b356f75ed4b14d0e83ee47f2bdbd0f98c8125191

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 701
content-type: text/html; charset=utf-8
date: Wed, 14 Dec 2022 03:33:51 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame C5A7 281 B
554 B 517ms
169ms Document
text/html 184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 14 Dec 2022 03:33:51 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame C2E8 3 KB
2 KB 275ms
94ms Document
text/html 104.18.36.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 398
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7793e1655fcc17ce-MEL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 14 Dec 2022 03:33:51 GMT
expires: Wed, 14 Dec 2022 07:33:51 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 61DE 52 KB
17 KB 468ms
86ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 13758
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 14 Dec 2022 03:33:51 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 02 Dec 2022 04:31:25 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 50, 18530
X-Served-By: cache-lga13626-LGA, cache-mel11247-MEL
X-Timer: S1670988832.782075,VS0,VE0

POST
H2 200 / Show response
emxhb.emxdgt.com/biddr/ 21 B
147 B 1192ms
289ms XHR
text/plain 52.21.197.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://emxhb.emxdgt.com/biddr/
Requested by: Host: biddr.brealtime.com
URL: https://biddr.brealtime.com/11772829-1659.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.21.197.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-21-197-24.compute-1.amazonaws.com
Software: /
Resource Hash: db3700959317a752159f42057335fc1c4b5cd87c90e99aa7dcbf262d345840a7

Request headers

Referer: https://forums.babypips.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Wed, 14 Dec 2022 03:33:51 GMT
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 21
content-type: text/plain

GET
H2 200 638e0a374508b9c2633690bc Show response
c.bannerflow.net/a/ Frame 654A 66 KB
23 KB 219ms
219ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/638e0a374508b9c2633690bc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvh4yKhmJ6RAZ-9GaS1tg30lqzYeMOPvsGp2alvTKXNYGjzuVOLLPZxcI9ksSNiuQKHtsZgmJlXYV3DMtCJaLptcPfLfGjCoExX2Pb1t2P31ZhCrK49fDeScqibpT4vsFnWxRw1cVGX9VjB-btXl6cJllAGnNPYkQ9MtnXgVRIBkBVdZplC7VxH6moLOpuQ3NdS_LfliAMcKyFoj_Hf7BDDpeKvsZD-zG42kEFpR2W8OemF0Oy40DWohvdmXOONkfkPbhUipTOSf-FfFd94DgV1_dzZgWzUJ7kE9k7v_xFl1lbL3901pYRcu2YgyrIa_O2lqKz3yZk2N206XOhCuXhWlEAPRImGOS1OmgbdE13g-KWujyXg7JgJCMrD9IjX0wTWXrpHpTO8pUD3LNkX-3V-9WtFn17X1gEmqS-ZiDPJSGQKt4aU6l7jBIK8wulh4bVPMPbGx8Ub6A%26sai%3DAMfl-YRD_cZdpXa_mWAki3iBTMlQ9n9nW18gYOC0L8ErrrY4QcgMEFAOBlZ_OuKToBjd2HN1Exr_wfpREA0aIp4ntQevFk3Wz7wEX47EftGOA5H_EPv9oXcOMgX-fgjI_Xku%26sig%3DCg0ArKJSzHvGrKyftmN7EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D8251485%26adurl%3Dhttps%253A%252F%252Fwww.fxcm.com%252Fau%252Ftrading-details%252Fspread-costs%252F%253FCMP%253DSFS-7010e0000012O5hAAE%2526dclid%253D%2525edclid!%2526utm_source%253Ddfa%2526utm_medium%253Dcpm%2526utm_campaign%253DBabyPips%2526utm_id%253D23952312%2526utm_content%253D183067591%2526utm_term%253D270614917
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1832608659671089152/AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df9d3657315dc878b66088c7fb44b1adb8163c1ae73ec156c8182e88372c0dd2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

request-context: appId=cid-v1:1a5f66bd-0229-467a-a946-b3753e659ecb
date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7793e1646c1c3778-MEL
content-type: application/javascript

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E89E 42 B
64 B 216ms
216ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstpHvpF3czHmpy-2qc4oc6ir-qPwL6rFe7zf8sQlKSNsLfKnfQuDSmWgtxH17Mv1qX03SFceJ3u8KNryzdWnPpXx6-RzjsbZ6wEUE_Uh7MjgLBC5ePy&sig=Cg0ArKJSzG4unn_Z4ePvEAE&id=lidar2&mcvt=1000&p=832,1084,882,1384&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=1011207388&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670988829148&rpt=1316&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3C47
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3482314458098331222&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

174ms
174ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3482314458098331222&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: jp-u.openx.net
URL: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://jp-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3482314458098331222&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3C47
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=b7f60573-cd25-41e5-ab27-6cc400f93aa2&ttd_puid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0&gdpr_consent=

43 B
62 B

178ms
177ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=b7f60573-cd25-41e5-ab27-6cc400f93aa2&ttd_puid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0&gdpr_consent=
Requested by: Host: jp-u.openx.net
URL: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://jp-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=b7f60573-cd25-41e5-ab27-6cc400f93aa2&ttd_puid=d0c92aae-6b15-3c4c-4d4c-2c6d0af0ef6a&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame 3C47
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y5lEIMCo5sIAAKqBOtQAAAAA

43 B
61 B

183ms
183ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y5lEIMCo5sIAAKqBOtQAAAAA
Requested by: Host: jp-u.openx.net
URL: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://jp-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Wed, 14 Dec 2022 03:33:52 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"103.209.254.5","key":"Y5lEIMCo5sIAAKqBOtQAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad230"}
X-SO-Key: Y5lEIMCo5sIAAKqBOtQAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad230
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y5lEIMCo5sIAAKqBOtQAAAAA
Cache-Control: private
X-SO-HostName: m-ad230.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 2
Content-Length: 0
X-SO-LB-Hostname: a-tgng40004.dc2p.scaleout.jp
X-SO-IP: 103.209.254.5

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame 3C47
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ac-cltWeTccwks8ADzHoqlvnzs8AAAGFDrIeIQ

43 B
61 B

174ms
173ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ac-cltWeTccwks8ADzHoqlvnzs8AAAGFDrIeIQ
Requested by: Host: jp-u.openx.net
URL: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://jp-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
via: 1.1 cebe7291f382f643e4ea2329a2d8016a.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=Ac-cltWeTccwks8ADzHoqlvnzs8AAAGFDrIeIQ
cache-control: no-cache
content-length: 0
x-amz-cf-id: 0BNzJYFDH1h2Cpqtjv3zk4rvNtheWy0XBxY4YULlAoBnvxvbvm-R4w==
expires: -1

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 3C47 170 B
188 B 220ms
219ms Image
image/png 172.253.118.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmNhNmY5NjQtYTI2Mi02MmU4LTU4YWMtNzZkNGMwMTIyMTBh

Requested by

Host: jp-u.openx.net
URL: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://jp-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3C47
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIYaptL_Bo3qOtP6__CkV-s&google_cver=1

43 B
61 B

174ms
174ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIYaptL_Bo3qOtP6__CkV-s&google_cver=1
Requested by: Host: jp-u.openx.net
URL: https://jp-u.openx.net/w/1.0/pd?plm=6&ph=7b29ee0a-2977-49bf-8a29-7873dec987b7&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://jp-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIYaptL_Bo3qOtP6__CkV-s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C348 0
20 B 222ms
222ms Image
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BLitaHESZY7z0Hc2bwgOg7ZGwAQAAAAA4AeAEAg&bg=!8vGl8bXNAAYgquz3AKo7ACkAdvg8Wiwaqty89wBQzPyXn1WLnw-IN-GPC3T8XA7xscLg8Bi6Vkn0ygIAAABuUgAAAAJoAQcKAFwwmvdH-7qEfpqTBpiu8ocsuloRPYyFoFVc9jbESHuulY8wjI3GOvRTT5vB3QieHFFKlRqdoYt705qmivJlZk-SCGQDHi9uUMOo_KK7hl26pQrZeH8MLOlFIYcmMpkDA3l5JdFgtlzcXhG8yiNbS1abO6vq8jKzRHuPwVmTOKMQoYyejxZcZZ7_hDfil399f-FvDjDdTW1oxyZCB95enkYcU2pedqmStiTJMLT1weFkVqz9WyCl0_lj57PRCgWTtuZm8VVKL-99MxysVp_dQhC5doXhH36KMVRxG6xBHBpDhL7PwMxwJSZ6fAlJS8kgfhanqDLWsOuyUQuJIfF_fLGxovLWb2QziIvL7kSO1rIZI3OsV98YSdHYHQSkxks1v6TNn-U4HactOOd9RQjwhbXd2i8Qfsys4lHM6c3oMcoXlwC9QlGo7672ovz2SN0ty0oa0mYnqCdr9QojpkeVmh_3vRMsu5ryaJzEs_6mkdretZ65PW29udSTShLKOJZLzPS5nXEhCAQiHAZZfG2NM3JMBIl0DXAhjYv5kmqgycpTukjbbJ2HrbM27j1-wZdqoYCiNgARGYLWffs6zbFfz9Ka8ED-jPcL1KEmhd7Y0dddOef6JEhsJPfLxd1zqCo7bwrFJyRG3aYNy8srA5BUwG7y7ZwbBuh62eT85vJsa36i0f7oNiJRNlrI-6mjKF4dUJSiOJDidfeqt-EtsktK5xeH1JDH3PNf-eX3X-6mGWDH8XXB1UFnf3n7yBFYod0GvX-hcWznJI-v2O-Jivlj6eRnCx2TPDiLnEMd1xBE0GyQumJJEDpwtTokSNr9vfpSa9kg_mX8v6kkyxv1kHoZpcGrNy5jU2aHITuirL6RuICVoPy2HfBkJEKoZMrdJmRj_HzOkNOZDYkjodYwRljy9NFB0zssfPJY1D7cG0KbPjU5jI16Ile1ewd_bQUNrv8ndCb1x6xVvPH0CuYhO-f9eDs8DNhTUDiHznOOCGxMfifHZZo1xIYmnni2GTX5OMTF2af_3qRiUWAiNcXsO3t9-j_x1I3VmOcw4XwnM-y0mUnufX2qNwKVrHBQKkdjhBnvJs9cdC9dOhLDkvd5fmMG2-sy67irX5o1B2xzMutvJtldWHcVgCWU3SHCaG3AEYAVhVL7xA

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 widget.ae34cc2dbe34ac8dcf59.js Show response
c.bannerflow.net/scripts/ Frame 654A 20 KB
7 KB 101ms
100ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.ae34cc2dbe34ac8dcf59.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/638e0a374508b9c2633690bc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvh4yKhmJ6RAZ-9GaS1tg30lqzYeMOPvsGp2alvTKXNYGjzuVOLLPZxcI9ksSNiuQKHtsZgmJlXYV3DMtCJaLptcPfLfGjCoExX2Pb1t2P31ZhCrK49fDeScqibpT4vsFnWxRw1cVGX9VjB-btXl6cJllAGnNPYkQ9MtnXgVRIBkBVdZplC7VxH6moLOpuQ3NdS_LfliAMcKyFoj_Hf7BDDpeKvsZD-zG42kEFpR2W8OemF0Oy40DWohvdmXOONkfkPbhUipTOSf-FfFd94DgV1_dzZgWzUJ7kE9k7v_xFl1lbL3901pYRcu2YgyrIa_O2lqKz3yZk2N206XOhCuXhWlEAPRImGOS1OmgbdE13g-KWujyXg7JgJCMrD9IjX0wTWXrpHpTO8pUD3LNkX-3V-9WtFn17X1gEmqS-ZiDPJSGQKt4aU6l7jBIK8wulh4bVPMPbGx8Ub6A%26sai%3DAMfl-YRD_cZdpXa_mWAki3iBTMlQ9n9nW18gYOC0L8ErrrY4QcgMEFAOBlZ_OuKToBjd2HN1Exr_wfpREA0aIp4ntQevFk3Wz7wEX47EftGOA5H_EPv9oXcOMgX-fgjI_Xku%26sig%3DCg0ArKJSzHvGrKyftmN7EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D8251485%26adurl%3Dhttps%253A%252F%252Fwww.fxcm.com%252Fau%252Ftrading-details%252Fspread-costs%252F%253FCMP%253DSFS-7010e0000012O5hAAE%2526dclid%253D%2525edclid!%2526utm_source%253Ddfa%2526utm_medium%253Dcpm%2526utm_campaign%253DBabyPips%2526utm_id%253D23952312%2526utm_content%253D183067591%2526utm_term%253D270614917
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3eb97681c227521f5b99f0d6d80d105b19cf362e925b5ce5c45270f2b7f27eb

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: vlZDxUf0ypFbqndESOb4ZQ==
age: 2361686
cf-polished: origSize=20291
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Mon, 07 Nov 2022 16:20:08 GMT
server: cloudflare
etag: W/"0x8DAC0DBF01C2451"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 9281c4ff-b01e-0048-3ef2-f9f011000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7793e165fedf3778-MEL

GET
H2 200 document.c5f8149fee.js Show response
c.bannerflow.net/accounts/fxcm/624ff6c94e4d7ee019f2b626/published/2925216/3951429/ Frame 654A 103 KB
17 KB 137ms
137ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/fxcm/624ff6c94e4d7ee019f2b626/published/2925216/3951429/document.c5f8149fee.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/638e0a374508b9c2633690bc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvh4yKhmJ6RAZ-9GaS1tg30lqzYeMOPvsGp2alvTKXNYGjzuVOLLPZxcI9ksSNiuQKHtsZgmJlXYV3DMtCJaLptcPfLfGjCoExX2Pb1t2P31ZhCrK49fDeScqibpT4vsFnWxRw1cVGX9VjB-btXl6cJllAGnNPYkQ9MtnXgVRIBkBVdZplC7VxH6moLOpuQ3NdS_LfliAMcKyFoj_Hf7BDDpeKvsZD-zG42kEFpR2W8OemF0Oy40DWohvdmXOONkfkPbhUipTOSf-FfFd94DgV1_dzZgWzUJ7kE9k7v_xFl1lbL3901pYRcu2YgyrIa_O2lqKz3yZk2N206XOhCuXhWlEAPRImGOS1OmgbdE13g-KWujyXg7JgJCMrD9IjX0wTWXrpHpTO8pUD3LNkX-3V-9WtFn17X1gEmqS-ZiDPJSGQKt4aU6l7jBIK8wulh4bVPMPbGx8Ub6A%26sai%3DAMfl-YRD_cZdpXa_mWAki3iBTMlQ9n9nW18gYOC0L8ErrrY4QcgMEFAOBlZ_OuKToBjd2HN1Exr_wfpREA0aIp4ntQevFk3Wz7wEX47EftGOA5H_EPv9oXcOMgX-fgjI_Xku%26sig%3DCg0ArKJSzHvGrKyftmN7EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D8251485%26adurl%3Dhttps%253A%252F%252Fwww.fxcm.com%252Fau%252Ftrading-details%252Fspread-costs%252F%253FCMP%253DSFS-7010e0000012O5hAAE%2526dclid%253D%2525edclid!%2526utm_source%253Ddfa%2526utm_medium%253Dcpm%2526utm_campaign%253DBabyPips%2526utm_id%253D23952312%2526utm_content%253D183067591%2526utm_term%253D270614917
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1412bea4213f16dd5c9876a1f5f1fc177467ba7c431c3d557701b0560738c596

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: xfgUn+5sNdagwHWFFNIqag==
age: 119557
cf-polished: origSize=114537
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Fri, 25 Nov 2022 14:15:14 GMT
server: cloudflare
etag: W/"0x8DACEEF78B29F31"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: aa6b905e-801e-0021-0756-0ec95d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7793e165fee53778-MEL

GET
H2 200 animated-creative.8edf018bf7f8eb3ba787.js Show response
c.bannerflow.net/scripts/ Frame 654A 149 KB
51 KB 101ms
100ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.8edf018bf7f8eb3ba787.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/638e0a374508b9c2633690bc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvh4yKhmJ6RAZ-9GaS1tg30lqzYeMOPvsGp2alvTKXNYGjzuVOLLPZxcI9ksSNiuQKHtsZgmJlXYV3DMtCJaLptcPfLfGjCoExX2Pb1t2P31ZhCrK49fDeScqibpT4vsFnWxRw1cVGX9VjB-btXl6cJllAGnNPYkQ9MtnXgVRIBkBVdZplC7VxH6moLOpuQ3NdS_LfliAMcKyFoj_Hf7BDDpeKvsZD-zG42kEFpR2W8OemF0Oy40DWohvdmXOONkfkPbhUipTOSf-FfFd94DgV1_dzZgWzUJ7kE9k7v_xFl1lbL3901pYRcu2YgyrIa_O2lqKz3yZk2N206XOhCuXhWlEAPRImGOS1OmgbdE13g-KWujyXg7JgJCMrD9IjX0wTWXrpHpTO8pUD3LNkX-3V-9WtFn17X1gEmqS-ZiDPJSGQKt4aU6l7jBIK8wulh4bVPMPbGx8Ub6A%26sai%3DAMfl-YRD_cZdpXa_mWAki3iBTMlQ9n9nW18gYOC0L8ErrrY4QcgMEFAOBlZ_OuKToBjd2HN1Exr_wfpREA0aIp4ntQevFk3Wz7wEX47EftGOA5H_EPv9oXcOMgX-fgjI_Xku%26sig%3DCg0ArKJSzHvGrKyftmN7EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D8251485%26adurl%3Dhttps%253A%252F%252Fwww.fxcm.com%252Fau%252Ftrading-details%252Fspread-costs%252F%253FCMP%253DSFS-7010e0000012O5hAAE%2526dclid%253D%2525edclid!%2526utm_source%253Ddfa%2526utm_medium%253Dcpm%2526utm_campaign%253DBabyPips%2526utm_id%253D23952312%2526utm_content%253D183067591%2526utm_term%253D270614917
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 825387ff0ac8e130e634343a37b26f90a75fa1e1787ef1a1ccec241336f36a27

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:51 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: VTggndMO5DyI7rNk4VU7eg==
age: 2361686
cf-polished: origSize=153055
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 16 Nov 2022 10:52:30 GMT
server: cloudflare
etag: W/"0x8DAC7C0A8EAFB11"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 84cd0f13-801e-0098-1ef2-f9cd47000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7793e165fee63778-MEL

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame C8EA 9 KB
4 KB 345ms
120ms Script
text/javascript 104.19.158.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.19.158.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b89b998c9ebc41459260eadda57b9d74a84a1db88982f2e2fd258d60299c4088

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
via: 1.1 8822644c95d28fdd6b7ad092cceb5b3e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MEL50-C2
age: 319
x-cache: Hit from cloudfront
last-modified: Mon, 07 Nov 2022 22:26:52 GMT
server: cloudflare
etag: W/"c4184a6b3aa67f65ca0651b5ff72ec70"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 7793e1677ea4df30-MEL
x-amz-cf-id: W_OD11xQoQCWTgLum3JsqgJ_NEa8hzPEFzcBu7s9o1pUfj9E9-4wUg==
expires: Wed, 14 Dec 2022 04:33:51 GMT

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 3F91 2 KB
1 KB 508ms
327ms Document
text/html 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51d86abef5902695d7234d8cd38248caafcc75a1ae245d6323151a63d903e54c

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7793e16738dadf1c-MEL
content-encoding: br
content-type: text/html
date: Wed, 14 Dec 2022 03:33:52 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aOG5GR6DWVaWTsOd%2FTKQaqQdol6cXQQpvreyq6eXmGeodWatyzDd5DP0VCkjHoXTCDTM7EamROU%2FHyVX%2BTw%2BGdQ262Bjix4dfy807iqrdQBP1H8fi4YhmZ8ODyIjK0LHAvaftE1IufJR7w%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 41BF 0
20 B 224ms
223ms Image
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BTF3nHESZY770Hc2bwgOg7ZGwAQAAAAA4AeAEAg&bg=!8_Cl8LTNAAYgquz3AKo7ACkAdvg8WoiH08ggVX9f5MG3NlcKSR7pSQEw-1mSbGUWlHwauWd_Rw_DDAIAAAB-UgAAAARoAQeZAv27EOVqhTBPGHucYgCqJ9dQg8gSGYSj07M8667xLznewurqFfFghHlRM1q-EpDyLB0Wkv98TZ8zRj91yoyFq1IOzeH_SQBQxAasRgfpeDPiGJ_SKmQuH57LUDUd4KX60MhZdHPh4RhJckEWeisRBqk39t8ISjhsSQRnTXe0Pp6keCMdj_KlA8jCWCo-qN-60Jz3B4etoUFxMqfn6rmsJWbNYFC8JIqdTtGjnaZSfHpIH18oEdp-2TPnmrzqMpMp-oJ6Y-mQD8ADUqNZ7pslhkcKAAWuPgNkp01ajxSLQa_bKpo7_lvkoXzTFibU35qlUE_1pUgk_kDrguSVNiBxk9aoVVfQc8bkK5upWR6EDquZao2Qwjgf219iQE73IOp1ZwmBmIdlc7ONSjzgVX42Uv-Kuevht5R8iYtIM2oh5gLDRGjRA_QmEvYHYpmHnv7TAlh9N8xOvQeHRJ36eJDUq2hZA8oCrqnF8gtLt5B1EKefxLH-MONFw3DHfu8Ukhb7n9VG6Bav3lHGp3nuCjXGDmACSjyDCKQ6AzdTmEhZehyRAX6HER8fUY5cx66Os-P84uaybc833mCMFZqvY7qjm56yp_cHp0Y0BIKQC83hP2ol4t9n9G-uHPPTL5yRdQhpBCWW-Ezv7jwDJjC6LnVlduQfYgCvyAAti1yqGlOzbJ6XM6Z_V16W0NlT51Ko-hYPS7RgCQwkJta_-OuOJachsahhUhVCqo_d8-BnFWo3InOfyBUpAzwd_ruVNGlsUxVJLFenChao6o1IvqjxkKqDImKG-5_at9oax-hPeecG126iYW6YTvIMNTWIKpebWNJzztChBsmhJRB-aMSwZ45YIgsvgFM2nV3aJnTOd_4mkomqBCvbb_ss2XbnqrrdRPgzHoiLfaZm4PDxBNogsOAH59C6BmmxDYEU60OSjbFewXqB8ALgH76q93Gk_RDDpI_9yPhH_p7uNOXEj3ygadXhdeDIyOrfbYBfaI5lpwvqYXoqnb9bAlxTs8FiekyAlaE

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ Frame E73C 44 KB
44 KB 670ms
222ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:700,regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 08:31:01 GMT
x-content-type-options: nosniff
age: 68571
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Dec 2023 08:31:01 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame C5A7 34 KB
10 KB 170ms
169ms Script
text/html 184.31.5.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.5.52 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-5-52.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: da7703b02caf19aa8b0d7431223134abe5ba64f8e2aeb5cd92c099073c9054af

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Wed, 14 Dec 2022 03:33:52 GMT
Content-Encoding: gzip
Last-Modified: Wed, 14 Dec 2022 02:58:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84190
Connection: keep-alive
Content-Length: 10066
Expires: Thu, 15 Dec 2022 02:57:02 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 61DE 0
743 B 237ms
236ms Script
text/html 104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:52 GMT
AN-X-Request-Uuid: cce8c844-e7f1-4030-8ec9-a03e6bf34347
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.5; 103.209.254.5; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 FXCM_Logo_White.svg
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 2 KB
962 B 262ms
261ms Image
image/svg+xml 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/FXCM_Logo_White.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

f7852897798ffcc2ee19c5415ecb8b07c8fb28e95a5c0abc0baf22d4d6493283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 934
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:52 GMT

GET
H3 200 glow.svg
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 581 B
365 B 265ms
263ms Image
image/svg+xml 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/glow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

d8a3ec702c4a52de2ce16aa043e3fb5b3eac0de107cc14213caa986a0def4978

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 337
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:52 GMT

GET
H3 200 btn-shadow.png
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 727 B
753 B 261ms
260ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/btn-shadow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

2153dfa04138a4de10a5aff52c437eca542515b3a05ba65a53c803dae00d9b96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 727
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:52 GMT

GET
H3 200 btc-160x600.png
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 15 KB
16 KB 229ms
228ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/btc-160x600.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

d854474a4569d59cd44539f36b96924bf63fe530377239e42317b98d9d2064ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15871
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:52 GMT

GET
H3 200 Shadow.png
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 2 KB
2 KB 255ms
254ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/Shadow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

717410eb5b5d3f45056c3ca51197e29cf233a6987ad8a46521fa15d20f32204a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2111
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:52 GMT

GET
H3 200 300x250.png
s0.2mdn.net/sadbundle/1024008988991631685/ Frame E73C 7 KB
7 KB 227ms
227ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1024008988991631685/300x250.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f148.1e100.net

Software

sffe /

Resource Hash

7aa1acf3f0b7fbd623119f164289c5165f42a246414d0f6906a6b25dd95909e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1024008988991631685/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7135
x-xss-protection: 0
last-modified: Tue, 02 Nov 2021 14:13:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Dec 2023 03:33:52 GMT

GET
DATA 200
OK truncated
/ Frame 654A 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 817e747d-3687-4210-afb6-40360685bbd6 Show response
https://s0.2mdn.net/ Frame 3C98 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://s0.2mdn.net/817e747d-3687-4210-afb6-40360685bbd6
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.8edf018bf7f8eb3ba787.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Length: 668

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4769 0
20 B 222ms
221ms Image
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Btw61HESZY7_0Hc2bwgOg7ZGwAQAAAAA4AeAEAg&bg=!ZmWlZSHNAAYgquz3AKo7ACkAdvg8WjKDRP26YIGiDWY5NbHIy89UKpDzvSy7gqACgJvM1WZOIxiFBwIAAADnUgAAAAJoAQcKAJV892xMZc4C9KGIQE5rNQtwzgfwSQMqbyhl3Puc844pw9IygSuJyPZ23UWwxQL1Q9SBBGWw_t33S0e_DDVVbcgqIlqWB8uDNu2ij-PH0luf94LfwYSO9vHcJpWsWQYaiD2FhxE08sV5L6ERJ7MBLujDaLj1IvMZ_Xnhv-z4m4wzZOTA36FwgO41xkKIUmaw7cob2nd9r5kC83eMb9XtMCy0Va_a_1cDu6GpmJg5_e-BbRkiNIIiWad4Fbi8H1Uzcbxk4A_CCeKEgKEkxatTfvGuBs4taLbpoFeF7_aua1B2Mht-FcL0NEaHlk7lF5_dhOHghlKBI3EvJdQeqLxyPQ7R4P54OPODYiv5jMAyoENT00iMwCPylGYI2AwcXZTMD-jdWI_9dLAhhRp_CTjBPYcU_2WM8Lu0k3xCqdkbudB_HGPYva6yHdj5fso0fWSPSaH6L9qCj0fD6kYlgj-xmF6w3wdm3p-D4SQ17QcsSlrgm1FcA3S80U3v-ti5Fw5OxgoM0Q_tT02IrzjIJKrHBWxDjXj_c_Bqe_oGcALrND_quQnw6ABHxScwuTeE0EEJRI5wooPPETPchofLxeKPZtWthflCRTtsdX1puREdchQyBD7kfvP02CVbZd5wYrvlf2AXyllI8mwv8g-aialvJnEN30bQOPnMle5KVhr4lSXkbyWAgBGBiyHUQ2uq0TfpPy9HUudrG6TMBWZmCnqhBCjTQhhCIgB4HM9aB7H3Og_jFkeclSJvw4V7qN-qj8TsaqeQGKLC4gJZh8nNrp-0OA237uKl35UHofswp8aP6Mx0EL3d-Ymqv7bF1StfP5LRRMvo3EwDTtM8xZ0EYG2Udn955LWlXAVaD36jPKZnQVqoPvk55qI2Th1x_vkNkdTlI6YuUwx5LCSZ6qmalEdT4OST_IAvTCedZh_KMmRRds91py3GtEceON8HXEGPmRGEwwlkWycnetIZnOt9WZUYRyUt5aS9Lqtm2NHDMq7O15JU6e3WrKPen2UrLmEvudB0llKqSU3OJ1F2H5QZqu0V35XT3m2X3f9JE3D7PY9YtEZI2-6FECc9qjTu9exGV6EhOLNFPwefgLd4jBWQ1bFg_42APzee-n3RggL5Puc6yfvcIK6FOvmUjuChYDhl20xP_eGIqvG8Oj4nLrxi-Rl_X9lDraHFwmh6mP9iM6IJHCBeMiu8HDsZQ4MnuHfU

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 654A 5 KB
6 KB 271ms
98ms Font
font/woff 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F624ff6c81b2d2f3aa96abd96%2F1c3c8dd2-0241-443e-8f3d-72e5c476d6f9.woff&t=%20.ASTacdefgilnoprstvy
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1832608659671089152/AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a58276f3dacb82516120612361df6d6182435254ba7fea7af9651e462704a0a8

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Mon, 12 Dec 2022 18:21:17 GMT
server: cloudflare
age: 119555
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=1c3c8dd2-0241-443e-8f3d-72e5c476d6f9-subset.woff
cf-ray: 7793e1696fc8df91-MEL
expires: Tue, 12 Dec 2023 18:21:17 GMT

GET
H2 200 widget.8df41d2671dfa891982b.js Show response
c.bannerflow.net/scripts/ Frame BC0F 20 KB
8 KB 108ms
107ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.8df41d2671dfa891982b.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6311b3a9a17d0b5ff3a09ad2?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1d598cb92aa54d28e5d648b5ea6e9abbdec81fe68a0001a654f5761762c64e7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: tpR60puMbYiCqblhTVcayg==
age: 6017110
cf-polished: origSize=20298
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 05 Oct 2022 10:59:47 GMT
server: cloudflare
etag: W/"0x8DAA6C0B7E8800F"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 657aed14-201e-0065-15b3-d84362000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7793e1688bb33778-MEL

GET
H2 200 document.e987f0b12d.js Show response
c.bannerflow.net/accounts/activtrades/5bc9a648f4ea2773b0608f61/published/2932010/3559973/ Frame BC0F 10 KB
4 KB 111ms
110ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/activtrades/5bc9a648f4ea2773b0608f61/published/2932010/3559973/document.e987f0b12d.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6311b3a9a17d0b5ff3a09ad2?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbb7171e25a9f09d5ce8f451fcafd6f4a764145770ae17aa34bb9ea361547db7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 6YfwsS25gjxdXo41O975Aw==
age: 5336188
cf-polished: origSize=10667
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 13 Oct 2022 09:05:27 GMT
server: cloudflare
etag: W/"0x8DAACFA120A5164"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 4e1f8af4-001e-004d-73e4-de22ca000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7793e1688bca3778-MEL

GET
H2 200 animated-creative.8efb8a8f987018efd96b.js Show response
c.bannerflow.net/scripts/ Frame BC0F 145 KB
50 KB 122ms
122ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.8efb8a8f987018efd96b.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6311b3a9a17d0b5ff3a09ad2?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d08bc37e61bd6df9b01a6e2571d67bd9dd5d741a22bfb5f0a3d0ecff71ed70e2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5cf6638e8e4e100001a17710&deeplink=on&a=6311b3a9a17d0b5ff3a09ad2&redirecturl=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 1mFSQH3i/58pkGoZGun9aA==
age: 6017109
cf-polished: origSize=148559
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 05 Oct 2022 10:59:47 GMT
server: cloudflare
etag: W/"0x8DAA6C0B7BE3F53"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d2d2bf51-601e-004b-16b3-d81175000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7793e1688bd03778-MEL

GET
H2 204 usync
id.a-mx.com/ Frame C8EA 0
515 B 303ms
102ms Image
text/plain 172.67.154.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.a-mx.com/usync?uid=b1a94680-3654-4715-a4aa-96c923ace3b1&gdpr_consent=
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.154.71 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-l1: AU
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBkwudACUFa5vNEdZVVT%2BkV%2FONa%2BWnBgQI7du%2FE3idTOOjNvQA69glNN0W6r8NJuBmq38yaRhTMVgYfC4SfE7W%2FfllIywTTXUmBygmyjoFFqcJuVq12Y8pylLKC4UA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private,max-age=0
cf-ray: 7793e16a6ca7a87d-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2

204

setuid
prebid.a-mo.net/ Frame C8EA
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=b1a94680-3654-4715-a4aa-96c923ace3b1&gdpr=0&gdpr_consent=&us_privacy=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=3f68ea01-d876-4123-83b2-3f55ccbc4e1c&ssp=adaptmx&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10524208644498154506&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10524208644498154506&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=fe0d3161-da90-4172-803f-57828f3bca4d&ssp=adaptmx&gdpr_consent=&gdpr=0
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10524208644498154506&ssp=adaptmx&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=208840804365001485731&ssp=adaptmx&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10524208644498154506&ssp=adaptmx&gdpr=0&gdpr_consent=
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=3f68ea01-d876-4123-83b2-3f55ccbc4e1c&gdpr=0&gdpr_consent=&us_privacy=

0
142 B

292ms
292ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=3f68ea01-d876-4123-83b2-3f55ccbc4e1c&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:54 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

Location: //prebid.a-mo.net/setuid?bidder=bid_switch&uid=3f68ea01-d876-4123-83b2-3f55ccbc4e1c&gdpr=0&gdpr_consent=&us_privacy=
Date: Wed, 14 Dec 2022 03:33:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame C8EA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=b1a94680-3654-4715-a4aa-96c923ace3b1
https://prebid.a-mo.net/setuid/yahoo?uid=y-smYkWalE2uG6yjH546ztJ5HbFrjcFuOZNaCjtzI-~A&gdpr=0&gdpr_consent=

0
115 B

290ms
290ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-smYkWalE2uG6yjH546ztJ5HbFrjcFuOZNaCjtzI-~A&gdpr=0&gdpr_consent=
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-smYkWalE2uG6yjH546ztJ5HbFrjcFuOZNaCjtzI-~A&gdpr=0&gdpr_consent=
date: Wed, 14 Dec 2022 03:33:52 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame C8EA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=
https://prebid.a-mo.net/setuid/magnite?uid=LBN3LRH4-13-48JM&gdpr=0

0
150 B

293ms
293ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LBN3LRH4-13-48JM&gdpr=0
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 5
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LBN3LRH4-13-48JM&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 38ddff6a66d3988dfd0c6ea3be81c5f1
Expires: 0

GET
H2 200 cookie
cm.adform.net/ Frame C8EA 43 B
106 B 995ms
329ms Image
image/gif 37.157.2.237

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?gdpr=0&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dadform%26uid%3D%24UID
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.237 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2

204

setuid
prebid.a-mo.net/ Frame C8EA
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dtriplelift%26uid%3D%24UID&gdpr=0&gdpr_consent=
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=triplelift&uid=3540352548715518921418

0
115 B

294ms
294ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=triplelift&uid=3540352548715518921418
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=triplelift&uid=3540352548715518921418
date: Wed, 14 Dec 2022 03:33:52 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET

a6da5bf591376177b08e1eb90117169d.gif
cs.iqzone.com/ Frame C8EA
Redirect Chain

https://ssp.disqus.com/redirectuser?partner=adaptmx&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dzeta%26uid%3D%24UID
https://ce.lijit.com/merge?pid=279534&3pid=ua-85dd1b12-965a-30f4-a48c-4ba8554cd840&gdpr=0&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRN...
https://ssp.disqus.com/match?bidder=12&buyeruid=F0AVDBZH_Nvn_DNUQuu3_Ouz&r=Cid1YS04NWRkMWIxMi05NjVhLTMwZjQtYTQ4Yy00YmE4NTU0Y2Q4NDAqfWh0dHBzOi8vcHJlYmlkLmEtbW8ubmV0L3NldHVpZD9BPWIxYTk0NjgwLTM2NTQtND...
https://cs.iqzone.com/a6da5bf591376177b08e1eb90117169d.gif?puid=[UID]&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS04...

0
0

GET
H2

204

setuid
prebid.a-mo.net/ Frame C8EA
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%...
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=smartadserver&uid=1745824891060393275

0
112 B

290ms
289ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=smartadserver&uid=1745824891060393275
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=smartadserver&uid=1745824891060393275
date: Wed, 14 Dec 2022 03:33:51 GMT
content-length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame C8EA
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjFBMkNBRTgtRTc5Ni00MzczLUI3NjctNUQ1ODIwMTk4NkY0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dpubmatic%26uid%3D61A2CAE8-E796-4373-B767-5D5...
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=pubmatic&uid=61A2CAE8-E796-4373-B767-5D58201986F4

0
135 B

291ms
290ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=pubmatic&uid=61A2CAE8-E796-4373-B767-5D58201986F4
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:53 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=pubmatic&uid=61A2CAE8-E796-4373-B767-5D58201986F4
date: Wed, 14 Dec 2022 03:33:53 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

setuid
prebid.a-mo.net/ Frame C8EA
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dindex_rtb%26uid%3D
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=index_rtb&uid=Y5lEHF2L62h5fnEzuPphwAAA%264682

0
112 B

289ms
289ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=index_rtb&uid=Y5lEHF2L62h5fnEzuPphwAAA%264682
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jMmluMnCeA8kqUEZfwxgiv4pvEyQAgWsOU6sYATJq4om2ob19OTcOAsPRp2BlZUYtSBgCvcDQI%2F2BWtZApAtnqNk6in0MRjxPeF3JbAuH8ETHU%2BoXLsGnOw%2FyQe3VIufmP1mJ%2Fnr"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=index_rtb&uid=Y5lEHF2L62h5fnEzuPphwAAA%264682
cache-control: no-cache
cf-ray: 7793e16a485c5aac-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame C8EA
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dsovrn%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=sovrn&uid=F0AVDBZH_Nvn_DNUQuu3_Ouz

0
112 B

292ms
291ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=sovrn&uid=F0AVDBZH_Nvn_DNUQuu3_Ouz
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:51 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Wed, 14 Dec 2022 03:33:52 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=sovrn&uid=F0AVDBZH_Nvn_DNUQuu3_Ouz
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame C8EA
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Db1a94680-3654-4715-a4aa-96c923ace3b1%26bidder%3Dappnexus%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=appnexus&uid=1414100499887693088

0
112 B

289ms
289ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=appnexus&uid=1414100499887693088
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:52 GMT
AN-X-Request-Uuid: 7ec3b2be-7d0f-486d-a562-ed243aed9781
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://prebid.a-mo.net/setuid?A=b1a94680-3654-4715-a4aa-96c923ace3b1&bidder=appnexus&uid=1414100499887693088
Connection: keep-alive
X-Proxy-Origin: 103.209.254.5; 103.209.254.5; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK setuid
ib.adnxs.com/prebid/ Frame C8EA 43 B
1 KB 229ms
228ms Image
image/gif 104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=b1a94680-3654-4715-a4aa-96c923ace3b1

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:52 GMT
AN-X-Request-Uuid: f73c03f4-92e9-40d4-bcd4-18201592bf3a
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.5; 103.209.254.5; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame C8EA 0
357 B 1070ms
343ms Image
image/avif 54.194.182.31

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=b1a94680-3654-4715-a4aa-96c923ace3b1
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.182.31 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:53 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 200 setuid
ow.pubmatic.com/ Frame C8EA 86 B
388 B 650ms
168ms Image
image/png 103.231.98.203

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=amx&uid=b1a94680-3654-4715-a4aa-96c923ace3b1
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.203 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:53 GMT
content-length: 86
content-type: image/png

GET
H2 200 setuid
pb-server.ezoic.com/ Frame C8EA 86 B
456 B 1009ms
323ms Image
image/png 18.184.243.181

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pb-server.ezoic.com/setuid?bidder=amx&uid=b1a94680-3654-4715-a4aa-96c923ace3b1
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.243.181 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 86
vary: Origin
expires: 0

GET
H2 200 setuid
pbs.nextmillmedia.com/ Frame C8EA 86 B
455 B 905ms
293ms Image
image/png 54.175.249.242

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pbs.nextmillmedia.com/setuid?bidder=amx&uid=b1a94680-3654-4715-a4aa-96c923ace3b1
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.175.249.242 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 86
vary: Origin
expires: 0

GET
H2 200 setuid
prebid-server.rubiconproject.com/ Frame C8EA 86 B
618 B 593ms
197ms Image
image/png 54.95.68.35

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=amx&uid=b1a94680-3654-4715-a4aa-96c923ace3b1
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.95.68.35 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
expires: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 3F91
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Y5lEHF2L62h5fnEzuPphwAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEN0lJz9La5nKE4_sRcpyL1E&google_cver=1

43 B
766 B

281ms
281ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEN0lJz9La5nKE4_sRcpyL1E&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEN0lJz9La5nKE4_sRcpyL1E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3F91
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=b7f60573-cd25-41e5-ab27-6cc400f93aa2&expiration=1673580832&gdpr=0&gdpr_consent=

43 B
766 B

889ms
297ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=b7f60573-cd25-41e5-ab27-6cc400f93aa2&expiration=1673580832&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=b7f60573-cd25-41e5-ab27-6cc400f93aa2&expiration=1673580832&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 3F91
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEI47EHzM22ROZm9mwKywiyI&google_cver=1

43 B
878 B

394ms
303ms

Image
image/gif

104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEI47EHzM22ROZm9mwKywiyI&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1oH6u9mvPsuKsrOuL3KpdXRhXER3Fhhyh0WXTdOJFSe%2BR5V8FMcJHXsOvT0zOPKEfxyUvVtj1XEKJKLb5MsjaZ51j6N%2FbAKq8R10AjR2It8iI4YdgPYwly0wuHdvH9ksvBNvH6raieC8Hw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 7793e16b4ce85a67-MEL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEI47EHzM22ROZm9mwKywiyI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 3F91
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&dcc=t

43 B
855 B

312ms
311ms

Image
image/gif

52.46.130.91

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Server

52.46.130.91 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: HMHZ7EJPE5H5QBXSTRYQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QVXSYX5VPMYKTHYBXSSW
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3F91
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=o5Lr0KGV4Nm4mODZo5H_2vCY4Iq4l-XQrMfSgP7L

43 B
766 B

573ms
280ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=o5Lr0KGV4Nm4mODZo5H_2vCY4Iq4l-XQrMfSgP7L
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=o5Lr0KGV4Nm4mODZo5H_2vCY4Iq4l-XQrMfSgP7L
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 3F91
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB

43 B
603 B

519ms
175ms

Image
image/gif

52.77.191.91

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Server

52.77.191.91 -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/Y5lEHF2L62h5fnEzuPphwAAAEkoAAAIB
date: Wed, 14 Dec 2022 03:33:52 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 3F91
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=UTQSEmCf1P5iwM5

43 B
766 B

407ms
296ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=UTQSEmCf1P5iwM5
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:52 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/595ea14#595ea1444a96c0bdac4aa333a73d7028cf966fc7 i-0d347ca036a683313@ap-southeast-1b@dxedge-app-ap-southeast-1-prod-asg
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=UTQSEmCf1P5iwM5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 3F91
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=7A47499C0C56449AA4D3186D176538A0

43 B
766 B

468ms
296ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=7A47499C0C56449AA4D3186D176538A0
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

date: Wed, 14 Dec 2022 03:33:52 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=7A47499C0C56449AA4D3186D176538A0
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 13 Dec 2022 03:33:52 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 3F91 43 B
353 B 302ms
115ms Image
image/gif 104.18.36.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y5lEHF2L62h5fnEzuPphwAAA%264682
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fforums.babypips.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 18275
etag: "da1f1d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7793e16a7f5d5a4f-MEL
content-length: 43
expires: Thu, 15 Dec 2022 03:33:52 GMT

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame C5A7
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=O9FcZOBkQXyKvTtPpZKwNA&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=O9FcZOBkQXyKvTtPpZKwNA

43 B
479 B

350ms
350ms

Image
image/gif

52.95.126.160

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=O9FcZOBkQXyKvTtPpZKwNA

Protocol

HTTP/1.1

Server

52.95.126.160 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: B9ZENM6VR0EP5GSJXTM4
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=O9FcZOBkQXyKvTtPpZKwNA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: dedf7fc216a5bbc739a54325e875a79f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame C5A7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELySJTlwPw_xb3wO6APTcrA&google_cver=1

42 B
691 B

225ms
171ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELySJTlwPw_xb3wO6APTcrA&google_cver=1
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELySJTlwPw_xb3wO6APTcrA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
px.ads.linkedin.com/ Frame C5A7
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBN3LRH4-13-48JM

0
596 B

585ms
361ms

Image
text/plain

13.107.42.14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBN3LRH4-13-48JM
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Server: 13.107.42.14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 62A80DD3E81848428FA410DD47F729C7 Ref B: MEL01EDGE1318 Ref C: 2022-12-14T03:33:53Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-source-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXvwWfU9LnLWufiyAv1OQ==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBN3LRH4-13-48JM
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C5A7
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJOM0xSSDQtMTMtNDhKTQ==

170 B
188 B

223ms
222ms

Image
image/png

172.253.118.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJOM0xSSDQtMTMtNDhKTQ==

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Server

172.253.118.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJOM0xSSDQtMTMtNDhKTQ==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d264e84c9dc1a645a3048554992c5d82
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame C5A7
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=b7f60573-cd25-41e5-ab27-6cc400f93aa2&gdpr=0&gdpr_consent=&expires=30

42 B
691 B

171ms
171ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=b7f60573-cd25-41e5-ab27-6cc400f93aa2&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: dedf7fc216a5bbc739a54325e875a79f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:52 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=b7f60573-cd25-41e5-ab27-6cc400f93aa2&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C5A7
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDcwN2IyZjg0ZDRiYjAyZmY5NWMyOTVjYTdlMWNlZmI1Njk3MWIzOQ

170 B
188 B

220ms
219ms

Image
image/png

172.253.118.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDcwN2IyZjg0ZDRiYjAyZmY5NWMyOTVjYTdlMWNlZmI1Njk3MWIzOQ

Requested by

Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054

Protocol

Server

172.253.118.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDcwN2IyZjg0ZDRiYjAyZmY5NWMyOTVjYTdlMWNlZmI1Njk3MWIzOQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: beb52df1a5a4b2f2cb3f37642c514298
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame C5A7
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/rKaHnsECVpbyB_hFu8j_lMn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-VszGFEZE2oKkvj4OgcK3WxuF5aqbtVQa_ocm_Q--~A

42 B
691 B

172ms
171ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-VszGFEZE2oKkvj4OgcK3WxuF5aqbtVQa_ocm_Q--~A
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 94869a3d6d62a785bc2a9351b08a70bb
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Wed, 14 Dec 2022 03:33:53 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 2
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-VszGFEZE2oKkvj4OgcK3WxuF5aqbtVQa_ocm_Q--~A
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame C5A7
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=1OY__EiBQsy4vHLQ-rKJuA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=1OY__EiBQsy4vHLQ-rKJuA

43 B
479 B

297ms
297ms

Image
image/gif

52.46.130.91

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=1OY__EiBQsy4vHLQ-rKJuA

Protocol

HTTP/1.1

Server

52.46.130.91 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:54 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 3C8JBYXHH6GAKMBX67GH
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=1OY__EiBQsy4vHLQ-rKJuA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 94869a3d6d62a785bc2a9351b08a70bb
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 654A 7 KB
7 KB 96ms
95ms Font
font/woff 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F624ff6c81b2d2f3aa96abd96%2Fd469aea6-a48b-4eb7-a815-1869f3be90e5.woff&t=%20%25.%2F45ACDEFLNOPRSTWXacdefgikmnoprstu
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1832608659671089152/AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77ee5cdbbf4c16d6675e1a84b3d9efea52c9668de9826d9bf9fecf6d7b8ee15e

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Mon, 12 Dec 2022 18:21:18 GMT
server: cloudflare
age: 119554
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=d469aea6-a48b-4eb7-a815-1869f3be90e5-subset.woff
cf-ray: 7793e16a08badf91-MEL
expires: Tue, 12 Dec 2023 18:21:18 GMT

GET
DATA 200
OK truncated
/ Frame BC0F 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 8f9ac877-55ba-4f51-9054-084c8da0165f Show response
https://c.bannerflow.net/ Frame 4F01 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://c.bannerflow.net/8f9ac877-55ba-4f51-9054-084c8da0165f
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.8efb8a8f987018efd96b.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Length: 668

GET
H2 200 a15f940a-efd8-40cf-acb6-d8073e48dc46.svg
c.bannerflow.net/accounts/activtrades/5bc9a648f4ea2773b0608f61/images/ Frame F015 14 KB
5 KB 102ms
101ms Image
image/svg+xml 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/activtrades/5bc9a648f4ea2773b0608f61/images/a15f940a-efd8-40cf-acb6-d8073e48dc46.svg
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e511ba0fa5fdf0a5efe1af8220a88ba1d9cf7f7b6bf710b8eb0fffa319f8029e

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: nChP+XVImmOEXCMSuZADPw==
age: 6942
x-ms-lease-status: unlocked
last-modified: Thu, 01 Sep 2022 11:19:06 GMT
server: cloudflare
etag: W/"0x8DA8C0BC88C9A6F"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: fe75a8d3-001e-0062-30e4-de2f01000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7793e16a7ef13778-MEL

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame F015 486 B
710 B 102ms
102ms Image
image/webp 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Factivtrades%2F5bc9a648f4ea2773b0608f61%2Fimages%2F40bd0797-2767-4a91-84eb-5da916f1f71f.png&w=18&h=20&q=85&f=webp&rt=contain
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72e58226368315d91aa97f6db1540fd16dacd6296a1aab0ca3ef283ea37bfc1f

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Tue, 13 Dec 2022 04:10:24 GMT
api-supported-versions: 2.0
server: cloudflare
age: 84208
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7793e16a7ef63778-MEL
content-length: 486
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 654A 9 KB
9 KB 103ms
103ms Font
font/woff 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F624ff6c81b2d2f3aa96abd96%2F06363ea1-7f2d-4a89-8924-47ac7f2d30c1.woff&t=%20%23.%2F0123456789ABCDEFGHJKLMNOPRSTUYabcdefghilnorstuw
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1832608659671089152/AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d1378dad4952419a66f60248e4099d9a3db48b45dbe8643f2004023b8dddf7e

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Mon, 12 Dec 2022 18:21:19 GMT
server: cloudflare
age: 119553
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=06363ea1-7f2d-4a89-8924-47ac7f2d30c1-subset.woff
cf-ray: 7793e16aa9d4df91-MEL
expires: Tue, 12 Dec 2023 18:21:19 GMT

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 4A87 7 KB
7 KB 118ms
117ms Image
image/webp 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Ffxcm%2F624ff6c94e4d7ee019f2b626%2Fimages%2F775f79bc-2321-4519-a419-b33272d71e85.jpg&w=728&h=90&q=99&f=webp&rt=contain
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1fdc433014bdb1d20125cd92dcf469a77996d118542e37f9e4707f7fb5598331

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Tue, 13 Dec 2022 20:22:31 GMT
api-supported-versions: 2.0
server: cloudflare
age: 25881
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7793e16bb8ca3778-MEL
content-length: 7280
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 4A87 5 KB
5 KB 99ms
98ms Image
image/webp 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Ffxcm%2F624ff6c94e4d7ee019f2b626%2Fimages%2Fb29d8f4d-2112-48eb-b94e-7a93efe6858e.png&w=728&h=90&q=99&f=webp&rt=contain
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b473c1cf48d16aadc2c86eec795aa693d3b5365696889c2880e1ea1bc8ed4695

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Tue, 13 Dec 2022 20:22:30 GMT
api-supported-versions: 2.0
server: cloudflare
age: 25882
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7793e16bb8cd3778-MEL
content-length: 4844
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 4A87 6 KB
6 KB 98ms
96ms Image
image/webp 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Ffxcm%2F624ff6c94e4d7ee019f2b626%2Fimages%2F14882b36-5d22-4963-a54e-8edde9ec9a3c.png&w=202&h=139&q=99&f=webp&rt=contain
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b5fb7c2b9e8c3bed1e9743c0bb6bdf52a6dafdee31a120c0aca82068c23fa14

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Tue, 13 Dec 2022 20:22:32 GMT
api-supported-versions: 2.0
server: cloudflare
age: 25880
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7793e16bb8ce3778-MEL
content-length: 6370
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 fc9a21bd-490c-45f0-bc37-d9bdf4107e6f.svg
c.bannerflow.net/accounts/fxcm/624ff6c94e4d7ee019f2b626/images/ Frame 4A87 1 KB
915 B 97ms
97ms Image
image/svg+xml 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/fxcm/624ff6c94e4d7ee019f2b626/images/fc9a21bd-490c-45f0-bc37-d9bdf4107e6f.svg
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9668167618b300a223bfe8ad22fbdb2fff8e0dd05570de8b131ef08d612397ee

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: NA3WBKvjZrKn4WoQJAWOGA==
age: 887
x-ms-lease-status: unlocked
last-modified: Tue, 09 Aug 2022 11:51:06 GMT
server: cloudflare
etag: W/"0x8DA79FD717EE582"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 7136b10a-401e-0073-7a07-d8b5b5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7793e16bb8dd3778-MEL

GET
H2 200 131cba6c-9c01-467b-8db0-cef4144b1fef.svg
c.bannerflow.net/accounts/fxcm/624ff6c94e4d7ee019f2b626/images/ Frame 4A87 1 KB
1 KB 1167ms
1167ms Image
image/svg+xml 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/fxcm/624ff6c94e4d7ee019f2b626/images/131cba6c-9c01-467b-8db0-cef4144b1fef.svg
Requested by: Host: forums.babypips.com
URL: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c5001928596f69d53da30a4427140eec6569c328e03e3c16a613e099ac6ed26

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:53 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: pfY9KIcgveZeECOMl3FxLQ==
x-ms-lease-status: unlocked
last-modified: Mon, 01 Aug 2022 12:51:09 GMT
server: cloudflare
etag: W/"0x8DA73BC81CAB8AE"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: aa6ba367-801e-0021-2656-0ec95d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7793e16bb8e03778-MEL

GET
H2 200 gsap.min.js Show response
c.bannerflow.net/misc/libs/gsap/3.5.1/ Frame A77D 60 KB
24 KB 110ms
109ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/misc/libs/gsap/3.5.1/gsap.min.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/widget.ae34cc2dbe34ac8dcf59.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: WyDhubHD6tBc1sDDhRKFJg==
age: 1753
x-ms-lease-status: unlocked
last-modified: Thu, 22 Oct 2020 09:07:10 GMT
server: cloudflare
etag: W/"0x8D87669DBE25D7E"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3c1eda24-f01e-002b-599f-886dea000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7793e16be9363778-MEL

GET
H2 200 TextPlugin.min.js Show response
c.bannerflow.net/misc/libs/gsap/3.5.1/ Frame A77D 10 KB
4 KB 96ms
96ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/misc/libs/gsap/3.5.1/TextPlugin.min.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/widget.ae34cc2dbe34ac8dcf59.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3169b2726b5c785026813413eb505d88cb3b8d95f899b66153624266a9ef503

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: DOn//7fLVTPV/pYjKJokUQ==
age: 1874
x-ms-lease-status: unlocked
last-modified: Tue, 26 Apr 2022 11:12:28 GMT
server: cloudflare
etag: W/"0x8DA2775A64AD9B9"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5dd2e26d-001e-0000-6d4f-ebed26000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7793e16be9373778-MEL

GET
H2 200 MotionPathPlugin.min.js Show response
c.bannerflow.net/misc/libs/gsap/3.5.1/ Frame A77D 20 KB
9 KB 102ms
101ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/misc/libs/gsap/3.5.1/MotionPathPlugin.min.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/widget.ae34cc2dbe34ac8dcf59.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 670b4574ac00792fb78909b383658833cd5c776a7f5715b9e9a5670668506db8

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: QyV10aQjskvJeMWugUJ9Sg==
age: 1874
x-ms-lease-status: unlocked
last-modified: Tue, 26 Apr 2022 11:11:52 GMT
server: cloudflare
etag: W/"0x8DA277591530E37"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 05b25861-001e-004d-35a1-c622ca000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7793e16be9383778-MEL

GET
H2 200 ScrollToPlugin.min.js Show response
c.bannerflow.net/misc/libs/gsap/3.5.1/ Frame A77D 3 KB
2 KB 97ms
97ms Script
application/javascript 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/misc/libs/gsap/3.5.1/ScrollToPlugin.min.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/widget.ae34cc2dbe34ac8dcf59.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b80b934f3f4c2332dd8d77abd1354233647dfb138eec1c4f5a9c07fd69651a7

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 14 Dec 2022 03:33:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: RCeckZr9ahjy1CSocLy88Q==
age: 1753
x-ms-lease-status: unlocked
last-modified: Tue, 26 Apr 2022 11:12:06 GMT
server: cloudflare
etag: W/"0x8DA277599529108"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3aa9ee7a-701e-0078-8031-044ede000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7793e16be9393778-MEL

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 654A 5 KB
5 KB 96ms
96ms Font
font/woff 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F624ff6c81b2d2f3aa96abd96%2Fd469aea6-a48b-4eb7-a815-1869f3be90e5.woff%3Fr%3D0.6483268237297966&t=%0A%20%21CFMPTXadehilorstwy
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1832608659671089152/AD272AU_PayLessToTrade_New_728x90-638058499481057131-bda20692-13cd-49f6-8680-025305ef4e84.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b902447a906d0d06c8c9de797822319eedd4e0c573de46371aa609fa6a0556f9

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
cf-cache-status: HIT
last-modified: Mon, 12 Dec 2022 18:21:21 GMT
server: cloudflare
age: 119551
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=d469aea6-a48b-4eb7-a815-1869f3be90e5-subset.woff?r=0
cf-ray: 7793e16cac59df91-MEL
expires: Tue, 12 Dec 2023 18:21:20 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 026C 0
0 219ms
218ms Fetch
image/gif 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuv4UlcXy4JTTTSIexwJ_qfQD0sWXG0vU6phAWAN6T6U44HfcpBdgt9YuYNPdcjcR-rNoVtRnRL9-9d1TSca3ZYL8AWKxenjc6N0qlOw4NSle7RifE9hfPF6kzSHrPPgPojJ9-tQoogWcKECbdylHzNMpTeIkVXv-Z6EE4FAmkWJqKo2bEphsWjD9kfVLJmWBNRajwKby4V5GwX1gG9WkmKDDhGxrSkMlARCMTe5BsXmLtEN6MI90cft64DXxAEZHBnAB3ZH55rrrs3XXCTOy2Ym5q5L544hYIiWkWGbWBYCZRmhN0HVxAnr8cmA6489xtSliTD-8Jt2Q&sai=AMfl-YSMrF0SxqpUv-zRuyuXdn-UNBE-SNG5H488qTbd8wVkpCGDUcP11wmZVkeZazZ1T6TPpFNTmHT8NrCgLA__Upi11VyCcvczZkjTQcnDkquHXXEhyBxh_GOS1Rpa_wJE&sig=Cg0ArKJSzFIIGd8YuZh0EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Dec 2022 03:33:52 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 61DE 0
743 B 228ms
228ms Script
text/html 104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Dec 2022 03:33:53 GMT
AN-X-Request-Uuid: 86a7dad0-ab14-4ded-af92-0d2ec3ad9930
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.209.254.5; 103.209.254.5; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 223ms
222ms XHR
application/json 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022120501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

f9fb6aa1f75d1ef9be62d306a828fe498211e6bc93d7648684d9f9c95c079bb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11279
x-xss-protection: 0

POST
H2 200 poll
forums.babypips.com/message-bus/1b2e56f0fcfa4a7e9596306c7310ddc0/ 321 B
0 309ms
308ms XHR
text/plain 34.224.142.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.babypips.com/message-bus/1b2e56f0fcfa4a7e9596306c7310ddc0/poll

Requested by

Host: f.bpcdn.co
URL: https://f.bpcdn.co/brotli_asset/ember_jquery-36a23101c869ab0dc53fc908de69adb785731593573d32bdeef416acc1076ef4.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.142.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-224-142-149.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Discourse-Present: true
X-CSRF-Token: undefined
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-SILENCE-LOGGER: true
Accept: text/plain, */*; q=0.01
Referer: https://forums.babypips.com/t/curtis-fox-forex-scammer/422054
X-Requested-With: XMLHttpRequest

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://forums.babypips.com
cache-control: must-revalidate, private, max-age=0
access-control-allow-headers: X-SILENCE-LOGGER, X-Shared-Session-Key, Dont-Chunk, Discourse-Present
expires: 0

POST
H2 200 /
c.bannerflow.net/tr/v2/pixel/ Frame 654A 0
91 B 187ms
186ms Ping
text/plain 104.16.13.64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/638e0a374508b9c2633690bc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvh4yKhmJ6RAZ-9GaS1tg30lqzYeMOPvsGp2alvTKXNYGjzuVOLLPZxcI9ksSNiuQKHtsZgmJlXYV3DMtCJaLptcPfLfGjCoExX2Pb1t2P31ZhCrK49fDeScqibpT4vsFnWxRw1cVGX9VjB-btXl6cJllAGnNPYkQ9MtnXgVRIBkBVdZplC7VxH6moLOpuQ3NdS_LfliAMcKyFoj_Hf7BDDpeKvsZD-zG42kEFpR2W8OemF0Oy40DWohvdmXOONkfkPbhUipTOSf-FfFd94DgV1_dzZgWzUJ7kE9k7v_xFl1lbL3901pYRcu2YgyrIa_O2lqKz3yZk2N206XOhCuXhWlEAPRImGOS1OmgbdE13g-KWujyXg7JgJCMrD9IjX0wTWXrpHpTO8pUD3LNkX-3V-9WtFn17X1gEmqS-ZiDPJSGQKt4aU6l7jBIK8wulh4bVPMPbGx8Ub6A%26sai%3DAMfl-YRD_cZdpXa_mWAki3iBTMlQ9n9nW18gYOC0L8ErrrY4QcgMEFAOBlZ_OuKToBjd2HN1Exr_wfpREA0aIp4ntQevFk3Wz7wEX47EftGOA5H_EPv9oXcOMgX-fgjI_Xku%26sig%3DCg0ArKJSzHvGrKyftmN7EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D8251485%26adurl%3Dhttps%253A%252F%252Fwww.fxcm.com%252Fau%252Ftrading-details%252Fspread-costs%252F%253FCMP%253DSFS-7010e0000012O5hAAE%2526dclid%253D%2525edclid!%2526utm_source%253Ddfa%2526utm_medium%253Dcpm%2526utm_campaign%253DBabyPips%2526utm_id%253D23952312%2526utm_content%253D183067591%2526utm_term%253D270614917
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.13.64 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s0.2mdn.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 14 Dec 2022 03:33:53 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7793e1731db43778-MEL
content-length: 0
request-context: appId=cid-v1:2080cc18-71b2-4e5d-992c-a3d1331a0b3e

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 026C 42 B
64 B 216ms
216ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuHxALea4BFvjW2FP1ZnBHRifs4msKewFDtBz7mxfi5hrWVi2XSKLKTNsDPomM0GySh5CajRIsDSUr-7Q1uujNWR0MRbQX2Zloy6z9_HZUb20Uo2oyXqZs8N0D572YTJCx97hmbspSUGsTnf0iM0RTyhQ10j6ZFgwNiBWY73KhAhMXV9xAy4vlh&sig=Cg0ArKJSzPETzfGXM6K4EAE&id=lidar2&mcvt=1001&p=1052,1084,1302,1384&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&v=20221207&bin=7&avms=nio&bs=1600,1200&mc=0.59&vu=1&app=0&itpl=19&adk=1514395016&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670988829342&rpt=3525&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Dec 2022 03:33:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 245ms
245ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 03:33:53 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E24E 13 KB
5 KB 222ms
222ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 45751
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Dec 2022 14:51:23 GMT
expires: Wed, 13 Dec 2023 14:51:23 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 28B0 783 B
1001 B 528ms
227ms Document
text/html 142.250.4.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f105.1e100.net

Software

GSE /

Resource Hash

e1f0bf34406cf29568f6e4f27a8e75109dbdd0592e01392491f5028fd3b12401

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hRE7JgKAWsG_we7VBMClvg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.babypips.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-hRE7JgKAWsG_we7VBMClvg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 14 Dec 2022 03:33:54 GMT
expires: Wed, 14 Dec 2022 03:33:54 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame E24E 36 KB
16 KB 217ms
216ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 21:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23595
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 21:00:39 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 28B0 0
0 219ms
218ms Image
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022120501&jk=3242375731416201&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E24E 0
10 B 222ms
221ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?m552rA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 03:33:54 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 223ms
222ms Image
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022120501&jk=3242375731416201&bg=!6Oul66_NAAYgquz3AKo7ACkAdvg8WiVrtgbhalKHLlk5buv_yTmsr7gFfG_NmY2S1hiANaOWpU2RTQIAAABzUgAAAAJoAQcKAF2IyWjhFAxAGC_EtyFg7t-bGO5lXhDl2EIdATtJyLdwRbRd2d-X3U0PWBNbkB1A0pI5v10a3rPrnCSa6YNUwRxedemh58hwe320Lp-vNJpEbMaf8ROIVMb7kJmmZ8uZAvhLtDDgePSHKqPDx_t30EeINPFeSeWRk43Nw3mszVAKsg6brWss8AGLLjvC8wk07mLg4AMCSx9cUhw0r8b5JBSr8lfCs4XpF2OUaaCU4AzVPZnCrJX1Le-Rbh_MkErjDlC9YUQ2kkD_5bAEtHx6xkVPlJ6bsvU8jJ12zOxlMmwAtZuJp5VPzFJhQjad1nvv49YPbpcbrVETrNP-MGCudRz08_tPBHTeTBJ5seA-IZWKuI8sM6hdzOcu6_mLZVVXwTI-anLJTFayosaXFPU5iHqsmeECQnvp6vO8DgF7FqYdhPOeV4a4mAWIQUAs5xeGJreuz0mdrMwnMU6rNLsIlcX_MQP_VEmyE5Gk2MexKqJfWNoMXIIO4XU-aanh0py6_OfAtpTwY7cS7xPvwRYPhA-qGpJ7Q0lueLRLkwicmAJzn-9DDVlUsu43zugLN0FWna7nVtquhrJsSfPU8xefEE8ZTvQMHIIfYE_IAQ34dQ0Fuze3-9aSB3IqZJGqBNWEoZtSAvc9Q2zKyemxDXYndNX39_EfjS1wOcWdpokQGQ-f9X9O5xncjtB8CdgMGDyzX9QLQN5znMsNDuFcGzo12z9x3VinTyLzyOodV9QYDYRh2XI7yF7rJp-ySGJumsXr9rCYtpLW3fBdzp02ImvsOsuH0HXrUzO45KC3DdTuGrgee-e8OCiDId-zID8LUfdDWVCm1sdHCbCmyxVSyGH7YdvJhlIX9ld3KcBp3AHUlSonUdhNXLs64z5PfTSYHF2-qS32qlrDowiKvIzuoBr4jLp0b0KbBe-Fn0rmzyYYWfIRObaCmW_rbc6iXopi6A1XjxAzmF10QuaV7AdnF4m0HQPmOMa_uWbjlW6Ybv0V1F7cEFXpzZDpFJRQdcONTJD7FiVVVu0NoJMxakV2MKfVZ2pAbjCdTq4_9w5Vsnzs92Ke3Vyw_9gc-ctBunrt7lw6NXvfmM7ZQMkOLGeOYo8zmXOrdoIcXutH_Di_Zt9qNn3YLiLwCUJ7ZM3k
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://forums.babypips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cs.iqzone.com
URL: https://cs.iqzone.com/a6da5bf591376177b08e1eb90117169d.gif?puid=[UID]&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS04NWRkMWIxMi05NjVhLTMwZjQtYTQ4Yy00YmE4NTU0Y2Q4NDAqfWh0dHBzOi8vcHJlYmlkLmEtbW8ubmV0L3NldHVpZD9BPWIxYTk0NjgwLTM2NTQtNDcxNS1hNGFhLTk2YzkyM2FjZTNiMSZiaWRkZXI9emV0YSZ1aWQ9dWEtODVkZDFiMTItOTY1YS0zMGY0LWE0OGMtNGJhODU1NGNkODQwMgIMGjgC

Verdicts & Comments Add Verdict or Comment

126 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

80 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
forums.babypips.com/t/curtis-fox-forex-scammer	1969-12-31 23:59:59	Name: dt Value: 2022-12-14T03:33:47.478Z
.babypips.com/	1970-01-20 17:45:48	Name: _ga Value: GA1.2.729902634.1670988826
.babypips.com/	1970-01-20 08:11:15	Name: _gid Value: GA1.2.2048060353.1670988826
.babypips.com/	1970-01-20 08:09:48	Name: _gat Value: 1
.babypips.com/	1970-01-20 16:55:24	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Wed+Dec+14+2022+03%3A33%3A46+GMT%2B0000+(GMT)&version=6.24.0&hosts=&landingPath=https%3A%2F%2Fforums.babypips.com%2Ft%2Fcurtis-fox-forex-scammer%2F422054&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CSPD_BG%3A1%2CC0004%3A1
.forums.babypips.com/	1970-01-20 16:55:46	Name: __adroll_fpc Value: 55e6915fab8ccda84cbf13c747d98249-1670988826735
.babypips.com/	1970-01-20 10:19:24	Name: _fbp Value: fb.1.1670988826748.1271139000
.babypips.com/	1970-01-20 16:55:24	Name: _hjSessionUser_66086 Value: eyJpZCI6ImI1YWE2YTY3LWU4ZTUtNTk2Yy1iMWQ5LTI2MDA1M2NjZmMwYSIsImNyZWF0ZWQiOjE2NzA5ODg4MjY4MTAsImV4aXN0aW5nIjpmYWxzZX0=
.babypips.com/	1970-01-20 08:09:50	Name: _hjFirstSeen Value: 1
forums.babypips.com/	1970-01-20 08:09:48	Name: _hjIncludedInSessionSample Value: 0
.babypips.com/	1970-01-20 08:09:50	Name: _hjSession_66086 Value: eyJpZCI6IjBjNmU0OGQ3LTE0YzctNGFlMi1iOTFkLWUzNzJlYTBjZjQ4YiIsImNyZWF0ZWQiOjE2NzA5ODg4MjY4MzQsImluU2FtcGxlIjpmYWxzZX0=
forums.babypips.com/	1970-01-20 08:09:48	Name: _hjIncludedInPageviewSample Value: 1
.babypips.com/	1970-01-20 08:09:50	Name: _hjAbsoluteSessionInProgress Value: 0
.forums.babypips.com/	1970-01-20 16:55:24	Name: _jsuid Value: 2118030450
.forums.babypips.com/	1970-01-20 16:55:24	Name: __ar_v4 Value: %7CWKE6MKSUNNB7PHMNEK4DGH%3A20230013%3A1%7CQCPUQFKXDZCSJBCXUJZ6CC%3A20230013%3A1%7CAGSJGGLE2VH5BN4ZL4GWYO%3A20230013%3A1
.babypips.com/	1970-01-20 10:19:24	Name: bpa Value: e92e5755-1f32-5d56-8465-aff288600a89
.babypips.com/	1970-01-20 08:09:50	Name: bpas Value: fb043bf6-76be-58e4-bb66-f70ed8ba5e77
.openx.net/	1970-01-20 16:55:24	Name: i Value: 036515f7-c292-03bb-179a-e4856ed7dc97\|1670988827
.3lift.com/	1970-01-20 10:19:24	Name: tluid Value: 3540352548715518921418
.pubmatic.com/	1970-01-20 10:19:24	Name: KRTBCOOKIE_10 Value: 22808-YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI&KRTB&22883-YjkyZGRiMDgyZjA1NjQ4ODk5MTVkOTc4OWJmMGE2ZGI
.pubmatic.com/	1970-01-20 08:53:00	Name: PugT Value: 1670988826
.taboola.com/	1970-01-20 16:55:24	Name: t_gid Value: 1eaf709c-5f83-4562-af99-72ab41f75853-tucta92c99b
.yahoo.com/	1970-01-20 16:55:46	Name: A3 Value: d=AQABBBtEmWMCEEK3mw2mYhHEtAu4_uoWhcYFEgEBAQGVmmOjYwAAAAAA_eMAAA&S=AQAAAhkwZjxzpWpvw07RKmxCCrs
.bidswitch.net/	1970-01-20 16:55:24	Name: tuuid Value: 3f68ea01-d876-4123-83b2-3f55ccbc4e1c
.bidswitch.net/	1970-01-20 16:55:24	Name: c Value: 1670988827
.lijit.com/	1970-01-20 16:55:24	Name: ljt_reader Value: F0AVDBZH_Nvn_DNUQuu3_Ouz
.rubiconproject.com/	1970-01-20 16:55:24	Name: khaos Value: LBN3LRH4-13-48JM
.adnxs.com/	1970-01-20 10:19:24	Name: uuid2 Value: 1414100499887693088
.bidswitch.net/	1970-01-20 16:55:24	Name: tuuid_lu Value: 1670988828
.rlcdn.com/	1970-01-20 09:36:12	Name: pxrc Value: CJyI5ZwGEgUI6AcQABIFCOhHEAA=
.prebid.a-mo.net/	1970-01-20 16:55:24	Name: __amc Value: 1_1670988828_1670988828
.a-mo.net/	1970-01-20 16:55:24	Name: amuid2 Value: b1a94680-3654-4715-a4aa-96c923ace3b1
.prebid.a-mo.net/	1970-01-20 16:55:24	Name: sd_amuid2 Value: b1a94680-3654-4715-a4aa-96c923ace3b1
.outbrain.com/	1970-01-20 10:19:24	Name: obuid Value: b7924973-87d3-43fa-85b7-4ee287db024c
.casalemedia.com/	1970-01-20 16:55:24	Name: CMID Value: Y5lEHF2L62h5fnEzuPphwAAA
.casalemedia.com/	1970-01-20 10:19:24	Name: CMPS Value: 4682
.casalemedia.com/	1970-01-20 10:19:24	Name: CMPRO Value: 4682
.d.adroll.com/	1970-01-20 17:38:36	Name: __adroll Value: b92ddb082f0564889915d9789bf0a6db-g_1670988828-a_1670988826
.adroll.com/	1970-01-20 17:38:36	Name: __adroll_shared Value: b92ddb082f0564889915d9789bf0a6db-g_1670988828-a_1670988826
.pippio.com/	1970-01-20 16:55:24	Name: did Value: BN8xyeyza8BvKCHG
.pippio.com/	1970-01-20 16:55:24	Name: didts Value: 1670988828
.pippio.com/	1970-01-20 09:36:12	Name: nnls Value:
.doubleclick.net/	1970-01-20 17:45:48	Name: IDE Value: AHWqTUmUvPSKM0i1kQxxGGAIF3n65i2C9eU04I0ehNv9pG-rfs715SjKUIjHhiKZsV0
.babypips.com/	1970-01-20 17:31:24	Name: __gads Value: ID=735f2e50f02cd93a:T=1670988828:S=ALNI_Mba8hLTrNvlF0G_52SZrzh4Gosv_g
.babypips.com/	1970-01-20 17:31:24	Name: __gpi Value: UID=00000b9008753857:T=1670988828:RT=1670988828:S=ALNI_MaIX7O71HPbPhfGVBA_9PDCrxBy5g
.pippio.com/	1970-01-20 09:36:12	Name: pxrc Value: CJ2I5ZwGEgQIAhAAEgYI7OsBEAA=
.linksynergy.com/	1970-01-20 16:55:24	Name: rmuid Value: 66534dcf-f24e-42f6-b3ab-5b2558d1ebbb
.linksynergy.com/	1970-01-20 16:55:24	Name: icts Value: 2022-12-14T03:33:49Z
.rlcdn.com/	1970-01-20 16:55:24	Name: rlas3 Value: +nFhN20F6jnQnrPz+oo+NxNdbzepJFNgME8qDbgW+jE=
.openx.net/	1970-01-20 08:31:24	Name: pd Value: v2\|1670988831\|jElYiuvOiahI
.adsrvr.org/	1970-01-20 16:55:24	Name: TDID Value: b7f60573-cd25-41e5-ab27-6cc400f93aa2
.turn.com/	1970-01-20 12:29:00	Name: uid Value: 3482314458098331222
.openx.net/	1970-01-20 08:31:24	Name: univ_id Value: 537072971\|b7f60573-cd25-41e5-ab27-6cc400f93aa2\|1670988832075013
.ladsp.com/	1970-01-20 08:09:52	Name: cr Value: 1
.socdm.com/	1970-01-20 17:45:48	Name: SOSYNC Value: anNvbjp7Im9wZW54IjoxNjcwOTg4ODMyfQ
.adsrvr.org/	1970-01-20 16:55:24	Name: TDCPM Value: CAESFgoHcnViaWNvbhILCNiF993B4647EAUYBSACKAIyCwiYs5WG2OOuOxAFOAE.
.analytics.yahoo.com/	1970-01-20 16:55:24	Name: IDSYNC Value: "1770~28u3:175w~28u3"
.ladsp.com/	1970-01-20 17:45:48	Name: smn_uid Value: FDlj74SmD5r9-5CMLnmCCg8x6Kpb584
.ladsp.com/	1970-01-20 17:45:48	Name: lum Value: CKG8yPXQMBIFCAMQ0AU
.a-mx.com/	1969-12-31 23:59:59	Name: amuid2 Value: b1a94680-3654-4715-a4aa-96c923ace3b1
.prebid.a-mo.net/	1970-01-20 08:11:15	Name: _sv3_7 Value: 1
.prebid.a-mo.net/	1970-01-20 08:11:15	Name: _sv3_9 Value: 1
.prebid.a-mo.net/	1970-01-20 08:11:15	Name: _sv3_11 Value: 1
.pubmatic.com/	1970-01-20 10:19:24	Name: SyncRTB3 Value: 1672185600%3A220
.pubmatic.com/	1970-01-20 08:09:48	Name: ipc Value: 158355^https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253Db1a94680-3654-4715-a4aa-96c923ace3b1%2526bidder%253Dpubmatic%2526uid%253D%2523PMUID^1^0
.pubmatic.com/	1970-01-20 08:11:15	Name: pi Value: 158355:2
.pubmatic.com/	1970-01-20 16:55:24	Name: KADUSERCOOKIE Value: 61A2CAE8-E796-4373-B767-5D58201986F4
.pubmatic.com/	1970-01-20 10:19:24	Name: chkChromeAb67Sec Value: 1
.prebid.a-mo.net/	1970-01-20 08:11:15	Name: _sv3_0 Value: 1
.adnxs.com/	1970-01-20 10:19:24	Name: anj Value: dTM7k!M40fQBY/ghqdmU(3#pOQxx]#?nFtN:uKeR_4^nZLmn?ApX)?rUr<X3)W[zAhW8hAg1v!3'r/=.cx).nz+4nIo2rbO$Zr`fO%6mJ[-TD._Pl[g2ozGM5YwX@uEA1'IDZ3(EGQ`XyY5.7YF[DT<T-n4eFuRVPEAX%[G:Nkd^U4I(PsXH%!#7R49n`5j
.adnxs.com/	1970-01-20 10:19:24	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJhbXgiOnsidWlkIjoiYjFhOTQ2ODAtMzY1NC00NzE1LWE0YWEtOTZjOTIzYWNlM2IxIiwiZXhwaXJlcyI6IjIwMjMtMDMtMTRUMDM6MzM6NTJaIn19LCJiaXJ0aGRheSI6IjIwMjItMTItMTRUMDM6MzM6NTJaIn0=
.smartadserver.com/	1970-01-20 17:40:03	Name: pid Value: 1745824891060393275
.rubiconproject.com/	1970-01-20 16:55:24	Name: audit Value: 1\|WD0cx+9RTMIV1Z4bBY7sdCKB0+A8/5OaCRXUPMqx8Ia+V121FzWhOIm/wHhQ0LSwq1cr+hFK5FdymPvo8pleP/9po14sTmPirVNW0iuGnHY=
.prebid.a-mo.net/	1970-01-20 08:11:15	Name: _sv3_3 Value: 1
.quantserve.com/	1970-01-20 10:19:24	Name: d Value: EDsBDQHnJ7jvsQA
.quantserve.com/	1970-01-20 17:40:03	Name: mc Value: 63994420-92060-3e92c-6799f
.mookie1.com/	1970-01-20 17:38:36	Name: id Value: 10524208644498154506
.mookie1.com/	1970-01-20 17:38:36	Name: mdata Value: 1\|10524208644498154506\|1670988832651
.mookie1.com/	1970-01-20 17:38:36	Name: ov Value: 44a2990a1a47c02e89ccf1cc41393a2d
.casalemedia.com/	1970-01-20 10:19:24	Name: CMTS Value: 4981

37 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://f.bpcdn.co/highlight-js/forums.babypips.com/cdefff4af52a8d2d43094b5d57ebca1fc7613a63.js Message: Failed to load resource: the server responded with a status of 403 ()
javascript	warning	URL: https://biddr.brealtime.com/check.js?nnn=1670988826880 Message: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network	error	URL: https://ad.atdmt.com/i/img;adv=11147208041415;ec=11147225831950;adv.a=8029426;c.a=23292337;s.a=5695026;p.a=256871051;a.a=453082171;cache=2688146527; Message: Failed to load resource: the server responded with a status of 400 ()
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://vars.hotjar.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://jp-u.openx.net').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://js-sec.indexww.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://acdn.adnxs.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://vars.hotjar.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://forums.babypips.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://jp-u.openx.net').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://js-sec.indexww.com').
security	error	URL: https://assets.a-mo.net/js/cframe.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://prebid.a-mo.net') does not match the recipient window's origin ('https://acdn.adnxs.com').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2b1b537fa04ba3d07994553d228e0088.safeframe.googlesyndication.com
a.babypips.com
a.bpcdn.co
aa.agkn.com
aax-eu.amazon-adsystem.com
acdn.adnxs.com
ad.atdmt.com
ad.turn.com
ads.servenobid.com
adservice.google.com
adservice.google.com.au
ajax.googleapis.com
ap.lijit.com
assets.a-mo.net
biddr.brealtime.com
c.bannerflow.net
cdn.indexww.com
cm.adform.net
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
cookie-cdn.cookiepro.com
cr-p3.ladsp.com
cs.iqzone.com
d.adroll.com
dsum-sec.casalemedia.com
e1.emxdgt.com
eb2.3lift.com
emxhb.emxdgt.com
eus.rubiconproject.com
f.bpcdn.co
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
forums.babypips.com
geolocation.onetrust.com
googleads4.g.doubleclick.net
htlb.casalemedia.com
ib.adnxs.com
id.a-mx.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image8.pubmatic.com
in.getclicky.com
in.hotjar.com
jp-u.openx.net
js-sec.indexww.com
match.adsrvr.org
media.fxcm.com
odr.mookie1.com
okodigital-d.openx.net
ow.pubmatic.com
pagead2.googlesyndication.com
pb-server.ezoic.com
pbs.nextmillmedia.com
pippio.com
pixel.rubiconproject.com
pixel.tapad.com
pm.w55c.net
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
prebid.a-mo.net
px.ads.linkedin.com
s.adroll.com
s.amazon-adsystem.com
s0.2mdn.net
script.hotjar.com
securepubads.g.doubleclick.net
ssbsync-global.smartadserver.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
static.getclicky.com
static.hotjar.com
stats.g.doubleclick.net
sync.outbrain.com
sync.taboola.com
tags.rd.linksynergy.com
tg.socdm.com
token.rubiconproject.com
tpc.googlesyndication.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
vars.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagservices.com
x.bidswitch.net
cs.iqzone.com
103.229.10.192
103.231.98.197
103.231.98.203
104.16.13.64
104.16.221.29
104.17.120.107
104.18.26.85
104.18.3.3
104.18.33.19
104.18.36.94
104.19.158.19
104.254.150.228
107.178.244.193
107.178.254.65
13.107.42.14
13.33.88.32
13.33.88.44
13.33.88.57
13.35.8.23
139.5.84.243
141.226.229.48
142.250.4.105
142.250.4.132
142.250.4.148
142.250.4.154
142.250.4.155
142.250.4.156
142.250.4.157
142.251.12.157
145.40.89.200
151.101.64.208
151.101.65.108
157.240.15.14
157.240.235.1
157.240.235.35
172.217.194.155
172.217.194.157
172.217.194.94
172.253.118.154
172.64.154.237
172.67.154.71
18.136.172.50
18.138.91.242
18.155.68.111
18.184.243.181
184.31.5.52
198.145.13.13
202.241.208.54
209.191.163.209
23.106.127.39
3.33.220.150
34.224.142.149
34.98.64.218
34.98.67.3
35.172.34.118
35.190.60.146
35.213.12.39
35.227.202.26
35.244.159.8
35.247.47.28
35.71.178.8
37.157.2.237
50.116.239.135
52.21.197.24
52.46.130.91
52.49.107.217
52.74.162.2
52.77.191.91
52.95.126.160
54.175.249.242
54.192.150.40
54.194.182.31
54.95.68.35
65.9.164.14
65.9.164.71
66.225.223.159
67.199.150.85
67.199.150.86
69.173.158.64
69.173.158.65
74.125.200.138
74.125.24.132
74.125.68.95
0604c8b2ecbf210e0b8ea0b386a26508660e66a42f6857064310db41d783462e
079cb31267c2a22f48cd702e20e4a07562b1099cf8d2cd987a9c46e888361253
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0e5cf82e4a17e79c80c6f17c3fff873756de944e1301fa01c1d03aba1e359669
0f2aac94d011ec45570ef1245e5fc8df73ebd09b1c6859c5a8393df5336e01b2
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1412bea4213f16dd5c9876a1f5f1fc177467ba7c431c3d557701b0560738c596
161df7c3f2c88ecdb80b0c33f8504645d59479e377b1344c48dc4a5eaca8d5f8
16c3a3e3f45b425c2ee002ecfe86f9a3e6e8268d6474a1adeeb13d32a9dd760a
175f1a33bfa3061d79c78b2011a5fe36a906a58d64a85ad0f925e79201dbeb81
17ae8213c11a3c486e7c083dd1bed59346670a1221eaa68e3c3191db508555a2
19089746082c9d1ae6b7fb6e3218eafa4411abffe26412d4d823cb304683c045
196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e
19cc1693a6c9244060a83f61b8832c624cadcc3ef5956a44be0197cfb13b215c
1bbf38f752477763f1db36d42b5cc451c2b0e692d192fb028669e4d086c78d06
1c9aebccb551bd64db9cec18901b0156f3b7bb1bb85b3cfd940f9d18cf658c4a
1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf
1fdc433014bdb1d20125cd92dcf469a77996d118542e37f9e4707f7fb5598331
20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394
20795ae824c5aa849754c6c07bcefb0f07dddd8747fa66453204a6b47a9b2cf6
2153dfa04138a4de10a5aff52c437eca542515b3a05ba65a53c803dae00d9b96
246773ec64f9df778c7a95f8ab4085d934beb0619448aac72ecd74a6edc5af7a
2614518f6510f0c9c4a6f45070a0e62c953d493dda37d25f3989854cf3815f56
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
26fb3657b5d5837dcd8a818b3989cfa2489ce251e40e0d023566eea8946bb07d
281d704874a4f296b2e6ec2fcd9464321440a876204662f267df4b0347aff7ca
28e7e652bdb6c55c2347e51f218cacfca5645711fa919dc879b25a5c88991aed
2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5
2c5001928596f69d53da30a4427140eec6569c328e03e3c16a613e099ac6ed26
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
3112293a28c64cbee8a4b661328486c7fd17188429bc15e47802e89728d8ab39
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
36e56ff433d1e7c0017688ed51d42dea37fc7a90431b54d4568df80746ed349b
37a00d243c3bc4c5a4a1e4fde67251f06cf484ee2275e663bc23e618560cc091
385aeac960c303b2810d72d3c7f776665a15d2f84d0ac5d1345e1c0a154cd604
38d34449d164b7b26815339e2bd9105b0639426bcf2230e33f84630bf409eebe
3969298c194b9f5a71031353aba7b3a9d8c684ab97e71ec7bf54cea4834d0fd5
3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b
3bcf66c42bfc0b91d9bd738779118c6e9d15ce7f1232f63f2b86dc68625bd019
3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3efbb0911716ff301f24daab29e528f6753e528297791bd3cf8fc57fe7866b8b
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47edd61cea73c8c619ac9807565305641e5a13da7d1998805af938c04770cd99
484e9d8c0aa2f0c493e081e62b78e5daf1c77787818a16dfe53a3ebab8bf5bae
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d0937fc80c0e26fa6055594c5af2e4e0aa0187766ffc41899e215543a3e3d30
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4eefdd923f73deeaec9e4ecb4cc3fae74379145f0fd3f5892165326bce8ed0ea
4ff176535630bc6ef4bbec05a418f74a41ba92b482f111bedbff9c9bea5b403e
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5145bbf30c52715e52d93342062b8c88774ae2b6a96d00d9ac602d976072c9b7
51d86abef5902695d7234d8cd38248caafcc75a1ae245d6323151a63d903e54c
53b4e8485067f1290a047a4a938e79e03a18cc18046c0d7d65912487b13f8b91
53e059ab1969d83c65c65590526e96a5fe0c808d4a5ea98ea6169a13f11a5ceb
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
557977af8d7c5c1c1ca7ff891c0c4a539ece895dd643866ba78493c1780278ac
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
573de750ad1066af5236424fc3f691a974660b9a26cbabfa50d388b499cb2912
58d4f943d20b4f22846e5473d773ca933107792111c7c5e9d9452ab33aacf818
5bac968f26265cb7afcd5c0203da3b7985105f8f0de97e84f9c12f7557e1de26
5d9d7e78e22202af03b2d09ad31952e031e3423006cba4a29fd506c5664c7761
5fafe19b2bda1f9130c1c632e69783f3c073fd8609893e8cce3645abe89893b0
6116464783e1c2b012f1f15212ed5a6f1dc1dee369b3636ef2831e34a59bf553
612d16789237243a86b1c3c7ce0ac9b619b6bb1286e01a27402f6aa28ae9700a
61b950d5252d06c0948e0c985cee3c34138ca2d419ec5512fa037a9e2d838fcc
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61f88a0d9295b799638b491f47c21a640c38547d24cd790024975aae466e56ae
670b4574ac00792fb78909b383658833cd5c776a7f5715b9e9a5670668506db8
67f3c6916558e920d3e143f8b356f75ed4b14d0e83ee47f2bdbd0f98c8125191
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6faf7671423b25917268e318f3b4c59344aa8e901b29b99e3348f2123b7e5d82
717410eb5b5d3f45056c3ca51197e29cf233a6987ad8a46521fa15d20f32204a
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
72e58226368315d91aa97f6db1540fd16dacd6296a1aab0ca3ef283ea37bfc1f
7362d3a1621d8f7e4e7ab5d812ec8a2f1fb1c69a1a79b6f885e68b7e2bc1bdae
7561b102c910bcd1c523ab9d7f44a2a9a8dfd2386f14a14df74153b0084d464c
777e5a7ddeca87a0fa0fdaa305ddc1195571e3453413b37bda5d53351cec89e5
77ee5cdbbf4c16d6675e1a84b3d9efea52c9668de9826d9bf9fecf6d7b8ee15e
79a05930356f93de515ecf8173134ec0c28e15b712e95413ba4f379ff6601893
7aa1acf3f0b7fbd623119f164289c5165f42a246414d0f6906a6b25dd95909e6
7b2355e9443af0a78ad159061a3b97388239f454d74869dee0192b3e10c31c69
7b5fb7c2b9e8c3bed1e9743c0bb6bdf52a6dafdee31a120c0aca82068c23fa14
7d1378dad4952419a66f60248e4099d9a3db48b45dbe8643f2004023b8dddf7e
7d875213b4c7f08845d0e368d80a9ad3725f554034e27b13554ddf2a9a5199ce
7fdd173b8ae243b9a321c3637c562cd2e9b2053b1320c17d58627a117d00a5e9
80a64d0e0cf6886659721e6f37817b0eef7e9fbfe331ea1ffe1ca0674a009177
81b9f3fd26ebc3ae316736187c3e6380e80fa9b02a406b59c7cde735354e192e
825387ff0ac8e130e634343a37b26f90a75fa1e1787ef1a1ccec241336f36a27
82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb
86869d87c0f591e8832857992e875ebe1e80a362c03fb6217a07b37a8f1d4afa
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
88bf02e57651bd6ed5f6dd802c4103f7088aa1f0872df19f78d4abdcfd4fcfac
88ca76900e2f34e199615b84ec4f674dd5854d0ff18a10778a6112a096435abd
8b80b934f3f4c2332dd8d77abd1354233647dfb138eec1c4f5a9c07fd69651a7
8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31
8d1cb9e6a95f358c8bb66afc6b7784822275c5cf07eeaf1833de1aced180a362
8f16871be8079e2ef038c404ac4ec3ebf5e07a4cf1860a9971d5409455cd98d7
9063a2202d854d610e7ad376068af697120c76a05023d93bdccdd04631818b6b
910612fc65208677f4e2fff60558e0f1949138a3696402a17ed5582efe0d2649
93fba53f976df6698cfc988486ed1cfe33f04d05fb9942b6f4517d3ffbfffe27
9487cb559d6168d8f29a5684b10a9c253776e7280ea758f332902773d85367e5
94b58f937eda4052c487b5aa11553b3526fea48cf8421e920ccec7b6468ba111
9668167618b300a223bfe8ad22fbdb2fff8e0dd05570de8b131ef08d612397ee
977d451e80d86ce0095b2583c1bc564c61fb80b90b6b36a0b940cb114d1f1813
9c27626364eeaffb44ad2decb980dace7bedb3c8ea1575f81927fc9409cb5b49
9c63bd05958b5790ad9961f80ebd3ee3becc8c51b077062e1024e2290e978cc9
9cc3372111d4e963830b30756f06195b4c1d1fd3b5ef817351451b8dbe2f9ccb
9f912c9f70335bc95d42c64646ed80292faefff4d6eda1ac6bebc822e8c82803
9fb445dd0d866a09fa93ed4ebdc175208bb09ab407126fc5fbae08cca6933e77
a0fabda398642f3b3ff7a4f9a23c02c21cfe79e612571efa4cdfebe88cd8ace0
a1403803173e5c95500724ef78b30133febf284c3fcca41aacf0f4b4c01e92ca
a1b03bb67724072d194ea166488218bdb2df55dc6ab4fa82690e5d492281125d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a58276f3dacb82516120612361df6d6182435254ba7fea7af9651e462704a0a8
a5c7086df4faeb13166aed8770fb13cc3a4a159158221f000c8d4130dfda4815
a6915794955aa02a862c6286b6ae26b9ad45b49d9a095ecd1c9d1b7f8b498778
a933fa87d48ac7c2f381036d364fa92767c5dae738491b16aa668671abc23442
a9f899953a47d5920ec441ecf4dad0b8907fd2b8bfe10857a6cdcbca0856b623
ad70578bc27f78725d2e11ab5de508e98cb8b8c4e82806bca17476037ce5e479
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1b2fda864f9dd8776a22d86fd0908027229fb9d3d2bf92fc65ebd406864a530
b1d598cb92aa54d28e5d648b5ea6e9abbdec81fe68a0001a654f5761762c64e7
b268ea27ad3a3239dbdbbd21130bd8ec516d60d5d524b28c3e9b0b60270cc960
b26d6da6f6f143147c8b3b0c3ba439290c409c6e17929bce9278906714d5b18f
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b43c593785438b113e3a75f0bb5b31b8b34a3bb49da7a184bfb50c72fa876b34
b473c1cf48d16aadc2c86eec795aa693d3b5365696889c2880e1ea1bc8ed4695
b4fa332fcf6779f8d263380fc203554bd7c20c65a2c3947a151561db476bff28
b671e2140966063715d21667867d60de45adc723cd1b31e0d2f7466105a90247
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
b89b998c9ebc41459260eadda57b9d74a84a1db88982f2e2fd258d60299c4088
b902447a906d0d06c8c9de797822319eedd4e0c573de46371aa609fa6a0556f9
ba2bfffbbf80471e6299cb0b63767ed6094245cda30aef15a9b32d3a37a2926d
bab745658ba458848b2d2df5e0557b98b70867124fd5a059fd25f9801e01a87c
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bd77054232ed0c5d26790a41cb1fc680313006286e56c7aad7179a0dfc57d1fe
bdda5fd122f247d9ac522edad66dad0f5874fd9cedd384cb8a974558b28d6837
bea4a236e94508496310b0f6ba7c4ef2e34f379fc5712c2ee28c663812a4b710
bec19b651f7faf6084fa089b4464cd567b837c5e2d67131da26a9bcd3cdbc69f
c009974b7a72da3bc9373f1374e6f02be5631bcfe688196e76ab04670271a9a7
c0f9a96a8b15dfa0bd82a9b0c4f7d31927c96784bb62af0a94fbaa78cde5e2fa
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf
c529f41df56b85f6205da08846ecf05e3c61b5c9939633d0481ac4e42f212f45
c7d7cc87200cabfd3db4669ab3b7ff421ae78d8b9311d10d4f0888e0ec29f333
ca206df6779f9d8cdc7e9abf119c4ed1af8b05238501a21442cc844e36aa56c9
cacbe8d075be5b96af1d81fa4753efcb5fdf25ae5acfbf8b6fe16fba1197eace
cbffce6f8642619af7ed7335e32750f7f2933765d32c113115da0710aa7deadc
cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876
cf140999642cf48bbf8a149b560f33fb8e80fadc2b2d7c0a9248f05f3587ff31
cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94
d08bc37e61bd6df9b01a6e2571d67bd9dd5d741a22bfb5f0a3d0ecff71ed70e2
d3169b2726b5c785026813413eb505d88cb3b8d95f899b66153624266a9ef503
d3eb97681c227521f5b99f0d6d80d105b19cf362e925b5ce5c45270f2b7f27eb
d854474a4569d59cd44539f36b96924bf63fe530377239e42317b98d9d2064ab
d8a3ec702c4a52de2ce16aa043e3fb5b3eac0de107cc14213caa986a0def4978
da7703b02caf19aa8b0d7431223134abe5ba64f8e2aeb5cd92c099073c9054af
db3700959317a752159f42057335fc1c4b5cd87c90e99aa7dcbf262d345840a7
dbc9ff2bfb671be765584f419efb6ab75b4c0f861d3e532d7bd695cc5e932e13
dd50ba290f74d344ad0d04ade63c55b02360bf4db99c0a2749f34deb0c8dcec9
ddc9ba2b04958970bed2b6db6ae1fe7d35a99fab13a513d6ca28fa54a16377f4
dea5d8ba9e54379b26e109f61ceba20a0781d4f80eed75fce6ad0993d4784195
df9d3657315dc878b66088c7fb44b1adb8163c1ae73ec156c8182e88372c0dd2
e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94
e1f0bf34406cf29568f6e4f27a8e75109dbdd0592e01392491f5028fd3b12401
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73
e511ba0fa5fdf0a5efe1af8220a88ba1d9cf7f7b6bf710b8eb0fffa319f8029e
e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc
e8f1973d1b29fd7596e579ec13ea05497cde3a54d3bffc31232516833c896ff2
ec2f6762f857fdc509ffa369c2b398982af1fa6cd2c0298d6088046fa757b852
ee495ae6f2eb9df7c28df85eac0ad1115411f90ba914e0e38bece9a27eee9216
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef68d22360154317ff26a3b00fb3616489a211161d3d32af5e0394fbcadd6646
ef910e2edab15a4fcdac975b228dfab8599c429100c0f2d19ed20963defc22da
f164b7d1707684b6749eb2f5154c84883cb9ec621dca72fc5147772b3c4237ff
f1cfd37041de744e174c8a24e9ba91cf0d8398dcba7c5ae4452237a38e6b5ee9
f29d46e273115e3b561afc0e2fd41543a2f7705aeda0d5bf060bdb755b9f78d1
f3260225ba132e9bf8956514e81f6136265ee05250271a027bb2029cbbf4651d
f44b3d75be2054aaaf255b3c930725313e036156789ecaa047d011cbdd04ff2a
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f60a67ba607267a113dd702a13de30fb6b08b278ea6eefe34d09d0400e25a53f
f7852897798ffcc2ee19c5415ecb8b07c8fb28e95a5c0abc0baf22d4d6493283
f9e5f0c55e7870d1af66deb9a35eeed0e62abefb64e3d57a415f10aff7e9facc
f9fb6aa1f75d1ef9be62d306a828fe498211e6bc93d7648684d9f9c95c079bb1
fa81d2df0436023d86d568a990152fb14be403b804d1856118ea29a13ba58a10
fbb7171e25a9f09d5ce8f451fcafd6f4a764145770ae17aa34bb9ea361547db7
fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

forums.babypips.com Open in urlscan Pro 34.224.142.149 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

294 Requests

83 %HTTPS

0 %IPv6

58 Domains

90 Subdomains

69 IPs

6 Countries

2897 kBTransfer

10774 kBSize

80 Cookies

35 Outgoing links

Redirected requests

294 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

forums.babypips.com Open in urlscan Pro
34.224.142.149 Public Scan

Screenshot
Live screenshot

Full Image

294
Requests

83 %
HTTPS

0 %
IPv6

58
Domains

90
Subdomains

69
IPs

6
Countries

2897 kB
Transfer

10774 kB
Size

80
Cookies

294 HTTP transactions
10 data transactions