xmod.in Open in urlscan Pro
2606:4700:3034::ac43:8960 Public Scan

Software

sffe /

Resource Hash

9f7cc558025bd359b5118c0e347e0501a7728b478af76dd21d55e7452540def8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28102
x-xss-protection: 0
server: sffe
etag: "1268 / 300 of 1000 / last-modified: 1657295190"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 08 Jul 2022 20:17:39 GMT

POST
H2 200 stream
a3.pubguru.net/ 0
0 71ms
24ms Ping
text/plain 52.5.78.75
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a3.pubguru.net/stream?beacon=test
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.78.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-78-75.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H/1.1 200
OK / Show response
balancer.lmgssp.com/ 2 B
234 B 430ms
365ms XHR
application/json 8.2.110.162
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://balancer.lmgssp.com/?c=o&m=multi
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 8.2.110.162 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://xmod.in
Date: Fri, 08 Jul 2022 20:17:40 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 97 KB
25 KB 421ms
273ms XHR
application/json 68.67.160.134
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.134 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

0ca85df395acafe9e2c568f88f6875dc489ab8977a355db5a699f4781c4565e5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 Jul 2022 20:17:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9b219003-85a5-4742-81b3-afb566d7e9a2
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://xmod.in
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 mvo Show response
tag.1rx.io/rmp/244272/0/ 0
155 B 89ms
27ms XHR
text/plain 67.226.210.221
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/244272/0/mvo?z=1r&hbv=5.7,2.1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.226.210.221 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://xmod.in
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:39 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
355 B 42ms
10ms XHR
application/json 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://xmod.in
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 408ms
180ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12a4ce5f0131&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 5aca11cfce8c5e9017094123452e10e07d62b9fa93214bf8a6d50dd0c7e438de

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 381ms
154ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12a820170132&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 21d908b982d79cb3a5c499f76574a092ce9f7b89a015e484003f118d6a9124de

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 447ms
220ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12a820170132&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: b198c0b578596aae8ee5800cbca66e8db6c5ef4b11700b848f2443b34538c7e8

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 372ms
146ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12a820170132&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 6593587d6f7ce5e9b821de0e3e0e60adfe06addad712522626cded2d3ded1c83

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 378ms
152ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12a820170132&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 17e8f823f0ca2bf6a1ad202dafd677be3a47f3236deafbd85a012a4852ee96e4

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
455 B 370ms
144ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12a820170132&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 6241e8d04d30faacf15aabcfbc5f51f2ce080c5472edc0ab0b56b7c577fdb0bb

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 418ms
193ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12aa205e0134&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 27880c9fe4c3525ada3a363a5b4b7e0eebc042197f727e01ec7c3da450f1308b

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
261 B 370ms
145ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969558018080038b3c12a2b894012f&pos=8a969558018080038b3c12a99b910133&cmd=bid&secure=1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 9ac7dd90b4b8a01a1f753ad63afcb0e1c069acd25017d7785d2194614619dcf9

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
content-length: 62

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 97 KB
24 KB 585ms
445ms XHR
application/json 68.67.160.134
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.134 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

db86297bc6481b83b28beef7c8de2f2ed58a2cee1eb9f63b94f548eef1e7f23e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 Jul 2022 20:17:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a1b1e306-8176-447c-bd49-889a7f1265a7
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://xmod.in
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 17 KB
2 KB 1168ms
791ms XHR
application/json 209.205.201.34
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.205.201.34 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS: static-34-201-205-209.24shells.net
Software: Adtelligent /
Resource Hash: 8a2f3cbb87df5aebea2b18ae7bf80534f48eb30a8e8a6774286cf3921339347d

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 Jul 2022 20:17:40 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://xmod.in
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 1425

POST
H2 200 pbjs Show response
lwgadm.com/ 4 KB
2 KB 104ms
104ms XHR
application/json 18.185.189.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lwgadm.com/pbjs?24784603
Requested by: Host: lwgadm.com
URL: https://lwgadm.com/lw/pbjs?pid=c470e392-a0b9-4f74-888a-12f92fae43f9
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.189.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-189-177.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 0cf3b5bff4c8b6198e2174a907c1d87774116ffa71a1e92dce306939f337660f

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
content-type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:39 GMT
content-encoding: gzip
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache,no-store,max-age=0,must-revalidate,private
access-control-allow-credentials: true
content-length: 1273

GET
H2 200 pubads_impl_2022063001.js Show response
securepubads.g.doubleclick.net/gpt/ 374 KB
128 KB 21ms
21ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84615457f9332569ff8501c382a395ef9fe116a9add5034b4ebc62c9bceeb3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 08:54:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40979
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 130816
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 08:35:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 08 Jul 2023 08:54:40 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 201 B
758 B 87ms
35ms XHR
application/json 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=xmod.in

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6ed8454fc699f5b17944c0db2218f5a474e83a9106f00f58f625ddb7c98a68e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122
x-xss-protection: 0
expires: Fri, 08 Jul 2022 20:17:39 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 172ms
25ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fxmod.in%2F&domain=xmod.in&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://xmod.in
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://xmod.in
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 08 Jul 2022 20:17:39 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1107
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fxmod.in%2F&domain=xmod.in&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=xZPEgHxNZVBhUTdxSkxjRDlNVDFLQVRFeVgvck4zcE5HOHJGTUFRcElsN3U0UlJvZXdObjRySUN0REpTc2FkU3ZXOXEvTEwwbS9ZRUl0U3ZzNnl3RllsZk5rOFhUZWsyQmQ5UUlmcmFabXFmdExpUDk0aHlpVUhvTHN5Yl...

320 B
594 B

72ms
25ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=xZPEgHxNZVBhUTdxSkxjRDlNVDFLQVRFeVgvck4zcE5HOHJGTUFRcElsN3U0UlJvZXdObjRySUN0REpTc2FkU3ZXOXEvTEwwbS9ZRUl0U3ZzNnl3RllsZk5rOFhUZWsyQmQ5UUlmcmFabXFmdExpUDk0aHlpVUhvTHN5Ylhoa1lPbFNBaXJnVGw5TGRXaW5XaGI1QkxHMWhsL1dUK1h2SENNdG9yWmI5K0RBa0lJaFhoUGpSd0w5VWw0YjljOHhIdG5WVDhYRnBDYnpHV2ZOK1lUN3FvUkxIN2xDMytXaUdkZS9EZVFQaldIWWRtTmIwPXw&cppv=2

Requested by

Host: xmod.in
URL: https://xmod.in/blog/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

f03c96596149ac7b91bf2925972c7d7614d836e43969c579acc09b45d425ed09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3278
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:39 GMT
location: https://mug.criteo.com/sid?cpp=xZPEgHxNZVBhUTdxSkxjRDlNVDFLQVRFeVgvck4zcE5HOHJGTUFRcElsN3U0UlJvZXdObjRySUN0REpTc2FkU3ZXOXEvTEwwbS9ZRUl0U3ZzNnl3RllsZk5rOFhUZWsyQmQ5UUlmcmFabXFmdExpUDk0aHlpVUhvTHN5Ylhoa1lPbFNBaXJnVGw5TGRXaW5XaGI1QkxHMWhsL1dUK1h2SENNdG9yWmI5K0RBa0lJaFhoUGpSd0w5VWw0YjljOHhIdG5WVDhYRnBDYnpHV2ZOK1lUN3FvUkxIN2xDMytXaUdkZS9EZVFQaldIWWRtTmIwPXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1455
content-length: 482
expires: 0

GET
H2 200 110220698 Show response
fundingchoicesmessages.google.com/i/ 104 KB
36 KB 121ms
61ms Script
application/javascript 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/110220698?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

02abff28fc8d9e46906eac5d04f576ac54670f7d966888651170a6886668a49e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-1UEQYSuwyG1JbKTrkd1R8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-1UEQYSuwyG1JbKTrkd1R8w' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-1UEQYSuwyG1JbKTrkd1R8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-1UEQYSuwyG1JbKTrkd1R8w' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorServingWebSwitchboardHttp"
x-frame-options: SAMEORIGIN
date: Fri, 08 Jul 2022 20:17:40 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorServingWebSwitchboardHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorServingWebSwitchboardHttp/external"}]}
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 53ms
26ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fxmod.in%2F&domain=xmod.in&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://xmod.in
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://xmod.in
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 08 Jul 2022 20:17:39 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1265
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fxmod.in%2F&domain=xmod.in&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=ZusDhXx5WG1UQm9hbUd0SWJoN3REWkFmRUZsbm5wWXlucFptWVBHNTEvNE5WWnBtUGJFaWlzNkxiY3E1V3loWFlJV250WDlCeHdkZFlaTDFKRHYvMkduRzlDRktjK1ZjbGRlMVN3dWVGWDFrZ3lCM2ltM09TU0Y4T3VlMF...

321 B
599 B

71ms
25ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=ZusDhXx5WG1UQm9hbUd0SWJoN3REWkFmRUZsbm5wWXlucFptWVBHNTEvNE5WWnBtUGJFaWlzNkxiY3E1V3loWFlJV250WDlCeHdkZFlaTDFKRHYvMkduRzlDRktjK1ZjbGRlMVN3dWVGWDFrZ3lCM2ltM09TU0Y4T3VlMFhib0ZpOWtGbVRGWU5kWXdEMWo5c2RXNEpjNnhvYVU2aTRRYTBhWGNYSk9mM3FsTDltVWo3aW4xVVZ1VnpEZmVuYlpWcWN0MlZuSk16NEQwYldxT0NYN1k0ck1SNzA4WjB4Z1k2NUE2Ri9pNXdvRUJEUXNzPXw&cppv=2

Requested by

Host: xmod.in
URL: https://xmod.in/blog/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

5deb82ca29c34aaef5620687bccd65d4f05cbb380d976362c02f45cdebb89722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:39 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3100
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
location: https://mug.criteo.com/sid?cpp=ZusDhXx5WG1UQm9hbUd0SWJoN3REWkFmRUZsbm5wWXlucFptWVBHNTEvNE5WWnBtUGJFaWlzNkxiY3E1V3loWFlJV250WDlCeHdkZFlaTDFKRHYvMkduRzlDRktjK1ZjbGRlMVN3dWVGWDFrZ3lCM2ltM09TU0Y4T3VlMFhib0ZpOWtGbVRGWU5kWXdEMWo5c2RXNEpjNnhvYVU2aTRRYTBhWGNYSk9mM3FsTDltVWo3aW4xVVZ1VnpEZmVuYlpWcWN0MlZuSk16NEQwYldxT0NYN1k0ck1SNzA4WjB4Z1k2NUE2Ri9pNXdvRUJEUXNzPXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1557
content-length: 482
expires: 0

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
941 B 56ms
19ms Script
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 26268
x-amz-request-id: tx86f8e995592547ee95ab9-00629f4bc7
x-amz-id-2: tx86f8e995592547ee95ab9-00629f4bc7
last-modified: Tue, 10 May 2022 09:57:32 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GelvWbwLhf3BapGo%2FcdfuV6qZ3frkrdfkHfvSZ5yCJj5qXCXRoC2Q%2Frn7IaSWg7ws9AO9yQ1sjjh%2Bb7QXaGz6ORqePySNeD4CFm5cWGrR53shvPcI0XkQKIWw8CACTbwkpg830ZSwnxnn1Lo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1652176652152482
cf-ray: 727b8131eb4cca53-YUL

POST /
prebid.smilewanted.com/ 0
0

POST
H2 200 prebid Show response
mp.4dex.io/ 116 B
487 B 143ms
101ms XHR
application/json 2606:4700::6812:372
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:372 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f51808b7b6e413f73fad4a2c0169c176e4b1fd27c5017f3924be86ec3898c9c

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

cf-ray: 727b813218bc4bb9-YUL
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://xmod.in
expires: 0
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
x-err: Parsing the Prebid Request. site archived

POST
H2 200 ad Show response
lwgadm.com/ 2 KB
809 B 705ms
705ms XHR
application/json 18.185.189.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lwgadm.com/ad
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.189.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-189-177.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5f0659247d5a6035cd4f7f38c39c940d828f5f6be3a9d259846c19e6a5b05177

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache,no-store,max-age=0,must-revalidate,private
access-control-allow-credentials: true
content-length: 544

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 17 KB
2 KB 517ms
222ms XHR
application/json 209.205.201.34
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.205.201.34 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS: static-34-201-205-209.24shells.net
Software: Adtelligent /
Resource Hash: 2d011dc7e79dbc60342b2f0fdc8a29cd095a7b9d8e7abb21b718f0974b0b46af

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 Jul 2022 20:17:39 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://xmod.in
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 1406

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 952 B
1 KB 134ms
97ms XHR
application/json 68.67.160.134
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.134 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

5f10ff18d15803d94d0a2a2c83c93cb70396cb4e1eaefeda58a6ad300dba570e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 Jul 2022 20:17:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a85e419c-b77d-4e27-b754-83c7f1643c80
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://xmod.in
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
23 KB 53ms
28ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 903546
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: txfa1f248f7c8c439f9ce7a-0062a0510c
x-amz-id-2: txfa1f248f7c8c439f9ce7a-0062a0510c
last-modified: Tue, 10 May 2022 09:57:31 GMT
server: cloudflare
etag: W/"2430496689c00115831347992a974246"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BnuOf56SQwNZl0Zdz6iQyLlspl%2BV7x3TX4mqsj2rCiGJVonoeNuEdp5jqdXO%2B6zYi2R4HPrvkzuI9%2FEBLOeoidkQMeB8CrfFz%2FdD9kqZXzrDhgYmMNFKyx17%2FkNZIfnc6saq0VbZbcX8VRLk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1652176651393042
cf-ray: 727b8132395bca47-YUL
access-control-allow-headers: Authorization

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 93ms
25ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1946
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 92ms
24ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 08 Jul 2022 20:17:39 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1563
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 AGSKWxUxOTHjD8PzuhV5EraZ4EgXdM7JURjeJvfr_kPFGBrCTRQ8Q1Pb8qZpjsx1QWydZG2VXYR8B8wFYKnUPIWiG7c= Show response
fundingchoicesmessages.google.com/f/ 73 KB
27 KB 130ms
89ms Script
application/javascript 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUxOTHjD8PzuhV5EraZ4EgXdM7JURjeJvfr_kPFGBrCTRQ8Q1Pb8qZpjsx1QWydZG2VXYR8B8wFYKnUPIWiG7c=?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjU3MzExNDYwLDI0MjAwMDAwMF0sIjExQzhGQzcxLTFDQUMtNDFERi1BQ0Q2LUJEMTg2NjZDRDJFQiIsIjlBMjE0MTU5LTJDRkMtNEIyNS05RTAxLUIxOUQzNzBGNEFGMCIsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3htb2QuaW4vYmxvZy8iLG51bGwsW11d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.I43QJp_ftU0.es5.O/d=1/rs=AJlcJMxrRNC2sRkiERZGlk2732-u5NRkzg/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

63f7017406b983ad155b297e611cc956dd7d71f9300694ed6c8488be5d24c6fb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KtEJ_O5alwZZ0-JU7xTLiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-KtEJ_O5alwZZ0-JU7xTLiA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-KtEJ_O5alwZZ0-JU7xTLiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-KtEJ_O5alwZZ0-JU7xTLiA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 127ms
36ms Script
application/javascript 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=xmod.in

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 87ms
39ms Script
application/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=xmod.in

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 101 KB
38 KB 396ms
355ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=23081961%3A22650038596%2Cpg_interstitial_xmod.in&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=291837412&sfv=1-0-38&ecs=20220708&ists=1&fas=8&fsapi=false&prev_scp=m2_config%3D11096-220518-fa2%25400%26m2_stack%3Denabled%26m2_cohort%3D1%253A2206221614%253A220518-fa2%253A11096%253A0.45%26m2_tc%3Dtc-init%26m2_canonical%3D08cd7fc63fd46f393a7dd9546189584d%26m2_canonical_session%3D08cd7fc63fd46f393a7dd9546189584d%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1657311460261&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=-1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e824e278442bc95c4725d7476d022a06f69c21e205197218ea7a5bfb2df12fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39302
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 011D 6 KB
4 KB 113ms
37ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads_2022063001.js Show response
securepubads.g.doubleclick.net/gpt/ 36 KB
13 KB 58ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022063001.js?cb=31068337

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebb8e8964b5b86218a37d73f701503ff287126d5573b27c20b654bcb2f5f8044

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 10:55:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 206519
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13574
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 08:35:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 06 Jul 2023 10:55:41 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 44ms
43ms Image
image/gif 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=10.419780808312467

Requested by

Host: xmod.in
URL: https://xmod.in/blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-P8IkZbO8FaIa3Nq38-F5jw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'nonce-P8IkZbO8FaIa3Nq38-F5jw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: script-src 'report-sample' 'nonce-P8IkZbO8FaIa3Nq38-F5jw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'nonce-P8IkZbO8FaIa3Nq38-F5jw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
date: Fri, 08 Jul 2022 20:17:40 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: image/gif
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 63ms
62ms Image
image/gif 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=2.5680446565164132

Requested by

Host: xmod.in
URL: https://xmod.in/blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-ViKJcN1wqSSPyYx6eC-nhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'nonce-ViKJcN1wqSSPyYx6eC-nhQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: image/gif
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-ViKJcN1wqSSPyYx6eC-nhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'nonce-ViKJcN1wqSSPyYx6eC-nhQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWv-nx5acIIPKlABRGfxZ24BDwylAIAq7EsuONj67fibI-yiWtG36d7an_f66v9CuKqcy1aBS4i1tw4pYhP9tl4oFCva5XG0nbS8HaWDxBQGDkT-MJKMJlHltIf1Jwis93yG8sIq8EzQwzd5jb9Gb6mFpP5NLZ9RMnZ8akZwYDWjfqs6lO1QJ-4Or_Z Show response
fundingchoicesmessages.google.com/el/ 0
28 B 87ms
45ms XHR
text/html 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWv-nx5acIIPKlABRGfxZ24BDwylAIAq7EsuONj67fibI-yiWtG36d7an_f66v9CuKqcy1aBS4i1tw4pYhP9tl4oFCva5XG0nbS8HaWDxBQGDkT-MJKMJlHltIf1Jwis93yG8sIq8EzQwzd5jb9Gb6mFpP5NLZ9RMnZ8akZwYDWjfqs6lO1QJ-4Or_Z

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.en_US.EvfasL-i-W4.es5.O/d=1/rs=AJlcJMyU9mblk8OwMgI3F3i4vlH3iiU0yg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-g69o7WbB0hkLhFt36h1Gkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-g69o7WbB0hkLhFt36h1Gkg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://xmod.in
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-g69o7WbB0hkLhFt36h1Gkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-g69o7WbB0hkLhFt36h1Gkg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 46ms
43ms XHR
application/json 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022063001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d54677c78ef354db0641de8048481bf86eefbb6d9ac3699a355a8ad0b59b324

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10982
x-xss-protection: 0

GET
H/1.1

200
OK

beacon Show response
ap.lijit.com/ Frame 9030
Redirect Chain

https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---
https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

5 KB
6 KB

21ms
20ms

Document
text/html

23.92.190.69
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/www/sovrn_beacon_standalone/sovrn_standalone_beacon.js?iid=13522617
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.69 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 01cfa0b162ed8dcd8df538395dfb139b8362b7b62a782ec8bc6e163d74ba1af4

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 5419
Content-Type: text/html
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap3ewr1

Redirect headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Location: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap3ewr1

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 127ms
75ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:40 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=c496c839-85ac-43f4-8cfc-e0d704d5c6b2

43 B
2 KB

19ms
19ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=c496c839-85ac-43f4-8cfc-e0d704d5c6b2
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: //ce.lijit.com/merge?pid=87&3pid=c496c839-85ac-43f4-8cfc-e0d704d5c6b2
date: Fri, 08 Jul 2022 20:17:40 GMT
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H/1.1

200
OK

epx.gif
px.owneriq.net/fr/ Frame 9030
Redirect Chain

https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent=
https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q7105978601712531473&ref=%2Feucm%2Fp%2Fsv
https://px.owneriq.net/fr/epx.gif

43 B
402 B

61ms
26ms

Image
image/gif

23.3.125.39
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/fr/epx.gif
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.3.125.39 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-3-125-39.deploy.static.akamaitechnologies.com
Software: Apache/2.4.6 (CentOS) / PHP/7.3.33
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: max-age=473465
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 14 Jul 2022 07:48:46 GMT

Redirect headers

Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://px.owneriq.net/fr/epx.gif
Cache-Control: max-age=53566
Connection: keep-alive
Content-Type: text/html
Content-Length: 154

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=70b3e8d7-cc97-480b-80ee-dad476c341d7&gdpr=0&gdpr_consent=

43 B
975 B

55ms
20ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=27&3pid=70b3e8d7-cc97-480b-80ee-dad476c341d7&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ce.lijit.com/merge?pid=27&3pid=70b3e8d7-cc97-480b-80ee-dad476c341d7&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 223

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=17&mt_exuid=E8WhbNZHCQrNXmybSwypSL-y&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D3%263pid%3D%5BUUID%5D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=3&3pid=bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=

43 B
974 B

64ms
28ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=3&3pid=bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x14 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ce.lijit.com/merge?pid=3&3pid=bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:39 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=83&3pid=L5CWGBIB-1H-DF2U&gdpr=0

43 B
3 KB

20ms
19ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=83&3pid=L5CWGBIB-1H-DF2U&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ce.lijit.com/merge?pid=83&3pid=L5CWGBIB-1H-DF2U&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 0163a7456b0a5605e8b1fb1d4fba3e4d
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=80&3pid=L5CWGBJG-1Y-B9H5&gdpr=0

43 B
3 KB

20ms
20ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=L5CWGBJG-1Y-B9H5&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ce.lijit.com/merge?pid=80&3pid=L5CWGBJG-1Y-B9H5&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 19ea072139d67f7022c6e463249c998e
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=E8WhbNZHCQrNXmybSwypSL-y&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:47cc0f51c742ab4c9a2fb927ebba91b9

43 B
973 B

77ms
20ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:47cc0f51c742ab4c9a2fb927ebba91b9
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:40 GMT
server: Aorta/20220620.4208e54c
location: https://ce.lijit.com/merge?pid=84&3pid=c:47cc0f51c742ab4c9a2fb927ebba91b9
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
access-control-allow-origin
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 5e2ad7f3010c
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H/1.1

200
OK

RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
sync.targeting.unrulymedia.com/csync/ Frame 9030
Redirect Chain

https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/sovrn?zcc=1&cb=1657311460664
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=895431781
https://sync.1rx.io/usersync/tradedesk/70b3e8d7-cc97-480b-80ee-dad476c341d7
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005

43 B
452 B

23ms
23ms

Image
image/gif

199.127.204.147
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 199.127.204.147 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Tengine
Connection: keep-alive
Content-Length: 43
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: Tengine
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9030
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RThXaGJOWkhDUXJOWG15YlN3eXBTTC15&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RThXaGJOWkhDUXJOWG15YlN3eXBTTC15&gdpr=0&google_tc=

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RThXaGJOWkhDUXJOWG15YlN3eXBTTC15&gdpr=0&google_tc=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RThXaGJOWkhDUXJOWG15YlN3eXBTTC15&gdpr=0&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://ce.lijit.com/merge?pid=85&3pid=AABZSU7FkSIAABCcZS66OQ&gdpr=0

43 B
2 KB

20ms
20ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=85&3pid=AABZSU7FkSIAABCcZS66OQ&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=85&3pid=AABZSU7FkSIAABCcZS66OQ&gdpr=0
Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=fmx&bsw_custom_parameter=254dd7d3-92b7-4826-982b-da30ccf966f8
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=fmx&bsw_custom_parameter=254dd7d3-92b7-4826-982b-da30ccf966f8
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=fe92e531-a0b2-45c4-b1fe-587b3e770f7b&user_group=1&ssp=fmx&bsw_param=254dd7d3-92b7-4826-982b-da30ccf966f8
https://ce.lijit.com/merge?pid=26&3pid=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=

43 B
4 KB

21ms
21ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: //ce.lijit.com/merge?pid=26&3pid=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=
Date: Fri, 08 Jul 2022 20:17:42 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=${gdpr}&gdpr_consent=${gdpr_consent}&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=23&gdpr=${gdpr}&gdpr_consent=${gdpr_consent}&gdpr=0&gdpr_consent=
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D24...
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D24...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&partner_url=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D16%263pid%3Da5a15d...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&partner_url=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D16%263pid%3D...
https://ce.lijit.com/merge?pid=16&3pid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=

43 B
4 KB

23ms
22ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=16&3pid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=16&3pid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=OTnv-zY76fciaLXwPjOh9mpo6PsiPemnbGhk3k8O

43 B
3 KB

20ms
19ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=OTnv-zY76fciaLXwPjOh9mpo6PsiPemnbGhk3k8O
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=OTnv-zY76fciaLXwPjOh9mpo6PsiPemnbGhk3k8O
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=12&3pid=2840070346914927031&gdpr=0&gdpr_consent=

43 B
3 KB

23ms
22ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=12&3pid=2840070346914927031&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3ed6c0d3-0fb8-43be-9db2-4b23dbeae563
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ce.lijit.com/merge?pid=12&3pid=2840070346914927031&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 9030
Redirect Chain

https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t

0
0

46ms
46ms

Image
text/html

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: VJJXNPD70RGA95D5WJT1
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=49&3pid=sctiKjRJymw0&ev=1&pid=558511&gdpr_consent=&gdpr=0

43 B
3 KB

22ms
22ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=49&3pid=sctiKjRJymw0&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://ce.lijit.com/merge?pid=49&3pid=sctiKjRJymw0&ev=1&pid=558511&gdpr_consent=&gdpr=0
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-57cd67f859-c76tl
expires: -1

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://um.simpli.fi/lj_match?r=1657311460529&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=472EAFCEE13948B5AAD5A88A32E34BD1

43 B
3 KB

22ms
21ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=472EAFCEE13948B5AAD5A88A32E34BD1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:41 GMT
x-content-type-options: nosniff
server: nginx
location: https://ce.lijit.com/merge?pid=2&3pid=472EAFCEE13948B5AAD5A88A32E34BD1
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 07 Jul 2022 20:17:41 GMT

GET
H2 200 cksync.php
contextual.media.net/ Frame 9030 45 B
623 B 89ms
44ms Image
image/gif 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=sov&ovsid=E8WhbNZHCQrNXmybSwypSL-y&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1023%263pid%3D%24%7BUSER%7D&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
server: Apache
date: Fri, 08 Jul 2022 20:17:41 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
https://ce.lijit.com/merge?pid=86&3pid=tTWIkAlvY1oGbv0lqHgF&pi=sovrn&gdpr=0&gdpr_consent=&tc=1

43 B
4 KB

20ms
20ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=86&3pid=tTWIkAlvY1oGbv0lqHgF&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=86&3pid=tTWIkAlvY1oGbv0lqHgF&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT, Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=1827&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=10&3pid=1783777314005288881

43 B
3 KB

26ms
25ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=10&3pid=1783777314005288881
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: https://ce.lijit.com/merge?pid=10&3pid=1783777314005288881
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9030
Redirect Chain

https://bcp.crwdcntrl.net/5/c=5436/tp=SVRN/tpid=E8WhbNZHCQrNXmybSwypSL-y/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=E8WhbNZHCQrNXmybSwypSL-y/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=5001&3pid=3eda220bd613d9f902fa275c6ac3c751&gdpr=0&gdpr_consent=

43 B
4 KB

23ms
22ms

Image
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=5001&3pid=3eda220bd613d9f902fa275c6ac3c751&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ce.lijit.com/merge?pid=5001&3pid=3eda220bd613d9f902fa275c6ac3c751&gdpr=0&gdpr_consent=
cache-control: no-cache
x-server: 10.40.9.26
content-length: 0
expires: 0

GET
H/1.1

200
OK

reporting
ap.lijit.com/dsp/google/ Frame 9030
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=RThXaGJOWkhDUXJOWG15YlN3eXBTTC15&gdpr=0
https://ap.lijit.com/dsp/google/reporting?gdpr=0

43 B
552 B

54ms
19ms

Image
image/gif

23.92.190.69
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/dsp/google/reporting?gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: *
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ewr1
Content-Type: image/gif
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ap.lijit.com/dsp/google/reporting?gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 245
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

cm Show response
us-u.openx.net/w/1.0/ Frame 514F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_c...
https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&g...

759 B
488 B

53ms
40ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 7078ad9024db85c5ea845ab1230e629a051ff1e06c6f9e74229c99e9df6b4a8e

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 469
content-type: text/html
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 08 Jul 2022 20:17:40 GMT
location: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/7f1e280
via: 1.1 google

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 063F 15 KB
6 KB 19ms
19ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52839
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:40 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 1E4C 15 KB
6 KB 19ms
19ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52839
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:40 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

merge Show response
ce.lijit.com/ Frame 3766
Redirect Chain

https://d.turn.com/r/dd/id/L21rdC8xMjcvY2lkLzI4NTUyOTczL3QvMg/url/https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1%263pid%3D%24!%7BTURN_UUID%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=1&3pid=8147514277513099876&gdpr=0&gdpr_consent=

43 B
2 KB

20ms
19ms

Document
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=1&3pid=8147514277513099876&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 43
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ewr1

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
date: Fri, 08 Jul 2022 20:17:40 GMT
location: https://ce.lijit.com/merge?pid=1&3pid=8147514277513099876&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
pragma: no-cache

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 063F 5 KB
6 KB 73ms
19ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=5976544&p=137711&s=137812&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: f0e5f98516f695a64e1f4c6fbd2ca37b328bd261e6c1b8174741054107c805a9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:39 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4C30 13 KB
5 KB 86ms
19ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 12031
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 16:57:09 GMT
expires: Sat, 08 Jul 2023 16:57:09 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4F64 783 B
1 KB 118ms
47ms Document
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8537668c931ec200fa315d1f13d0bd27e36e37b63d235d0a74f662bfd1c67dd6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-QGofB2cIUGHMtgnxn2lx2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-QGofB2cIUGHMtgnxn2lx2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Fri, 08 Jul 2022 20:17:40 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame C782
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=E614708A-96BB-452C-8A92-C68CD106CB31
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=E614708A-96BB-452C-8A92-C68CD106CB31

35 B
468 B

18ms
17ms

Document
image/gif

185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=E614708A-96BB-452C-8A92-C68CD106CB31

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=E614708A-96BB-452C-8A92-C68CD106CB31
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame BAD9
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YsiQ5AAO0ntNvgAo&gdpr=0&gdpr_consent=&_test=YsiQ5AAO0ntNvgAo

1 B
217 B

145ms
32ms

Document
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YsiQ5AAO0ntNvgAo&gdpr=0&gdpr_consent=&_test=YsiQ5AAO0ntNvgAo
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Fri, 08 Jul 2022 20:17:40 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YsiQ5AAO0ntNvgAo&gdpr=0&gdpr_consent=&_test=YsiQ5AAO0ntNvgAo
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-yul12834-YUL
x-timer: S1657311461.766256,VS0,VE0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame EAC0
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=

42 B
324 B

190ms
21ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Fri, 08 Jul 2022 20:17:39 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4475 c1dc35a master ord-pixel-x52 config:1.0.0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=

GET

redir
rtb-csync.smartadserver.com/ Frame 46CF
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCWlNVN0ZrU0lBQUJDY1pTNjZPUQ&bee_sync_partners=sas%2Csyn%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Csyn%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABZSU7FkSIAABCcZS66OQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsyn%252Cpp%252Cpm%26bee_sy...

0
0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 6A0B 0
221 B 80ms
24ms Document
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 2173 43 B
363 B 350ms
24ms Document
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Fri, 08 Jul 2022 00:00:00 GMT
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 796491
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 62C8
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=0481e10a-fefb-11ec-99ad-d15aeeec5f47

42 B
321 B

121ms
18ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=0481e10a-fefb-11ec-99ad-d15aeeec5f47
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 10:25:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Thu, 23 Sep 2004 17:42:04 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=0481e10a-fefb-11ec-99ad-d15aeeec5f47
P3P: CP="NOI OTC OTP OUR NOR"
Pragma: no-cache
X-RealServer-NX: lga-delivery-6
server: Cowboy

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame FD60
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=Tv-VE_VoS8FrWeCyM7c6GpU4mbM

42 B
203 B

83ms
20ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=Tv-VE_VoS8FrWeCyM7c6GpU4mbM
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 159
Content-Type: text/html; charset=utf-8
Date: Fri, 08 Jul 2022 20:17:40 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=Tv-VE_VoS8FrWeCyM7c6GpU4mbM

GET
H/1.1

200
OK

merge Show response
ce.lijit.com/ Frame DF3D
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=889418338
https://sync.1rx.io/usersync/tradedesk/70b3e8d7-cc97-480b-80ee-dad476c341d7
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D56%263pid%3DRX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
https://ce.lijit.com/merge?pid=56&3pid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005

43 B
2 KB

25ms
24ms

Document
image/gif

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=56&3pid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 43
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ewr1

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Fri, 08 Jul 2022 20:17:40 GMT
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Location: https://ce.lijit.com/merge?pid=56&3pid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server: Tengine
Transfer-Encoding: chunked

GET
H2

200

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame E1E5
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=1eca7e38-0499-408c-a40c-f012d86f7404&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=E614708A-96BB-452C-8A92-C68CD106CB31

42 B
350 B

39ms
24ms

Document
image/gif

52.205.37.96
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.37.96 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-37-96.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 42
content-type: image/gif
date: Fri, 08 Jul 2022 20:17:40 GMT
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Fri, 08 Jul 2022 09:19:31 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=E614708A-96BB-452C-8A92-C68CD106CB31
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C715
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=679578081597

42 B
190 B

88ms
20ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=679578081597
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=679578081597

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C1CB
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Nwgrv8Xp1O9Uq05&gdpr=0&gdpr_consent=

42 B
275 B

40ms
19ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Nwgrv8Xp1O9Uq05&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 10:00:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Nwgrv8Xp1O9Uq05&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/658332f#658332fc5aaa95d8a9be88d89d84d3c319923363 i-01c817e7afea962c5@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 7FA2
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
438 B

118ms
96ms

Document
image/gif

2606:4700:4400::6812:230b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 727b8136ceb1ca4f-YUL
content-length: 43
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 727b8135fdb1ca4f-YUL
content-type: text/html
date: Fri, 08 Jul 2022 20:17:40 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 1361

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B16C
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7105978601712531473

42 B
219 B

138ms
31ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7105978601712531473
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=17204
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Fri, 08 Jul 2022 20:17:40 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7105978601712531473
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H/1.1 200
OK merge Show response
ce.lijit.com/ Frame D695 43 B
975 B 26ms
20ms Document
image/gif 23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=58&3pid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 43
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:40 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ewr1

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 063F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5hRwipa7RSyKksaM0QbLMQ%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

22ms
20ms

Image
text/html

23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

Protocol

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52839
accept-ranges: bytes
content-type: text/html
content-length: 5549
x-xss-protection: 1; mode=block
expires: Sat, 09 Jul 2022 10:58:19 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame 063F
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=E614708A-96BB-452C-8A92-C68CD106CB31
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEU2MTQ3MDhBLTk2QkItNDUyQy04QTkyLUM2OENEMTA2Q0IzMRAAGg0I5KGilgYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=a3794f20212a8e73ddd4c6c724306e75a449bfd8782483380c38119f258567a0791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBhMzc5NGYyMDIxMmE4ZTczZGRkNGM2YzcyNDMwNmU3NWE0NDliZmQ4NzgyNDgzMzgwYzM4MTE5ZjI1ODU2N2EwNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBhMzc5NGYyMDIxMmE4ZTczZGRkNGM2YzcyNDMwNmU3NWE0NDliZmQ4NzgyNDgzMzgwYzM4MTE5ZjI1ODU2N2EwNzkxNDI2YjU0MTdkY2UyMRAAGgwI5aGilgYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=5c404c82-fa8e-4e03-8c6f-95fbf299564b

42 B
60 B

42ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=5c404c82-fa8e-4e03-8c6f-95fbf299564b
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=5c404c82-fa8e-4e03-8c6f-95fbf299564b
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=bea062c8-90e4-4c00-bf77-b3eaa870d307

0
260 B

506ms
81ms

Image
text/plain

104.36.113.24
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=bea062c8-90e4-4c00-bf77-b3eaa870d307
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.113.24 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x55 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=bea062c8-90e4-4c00-bf77-b3eaa870d307
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:39 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RTYxNDcwOEEtOTZCQi00NTJDLThBOTItQzY4Q0QxMDZDQjMx&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
245 B

99ms
18ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKnm4UHgKcftNUdLDAWmO1o&google_cver=1

42 B
376 B

98ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKnm4UHgKcftNUdLDAWmO1o&google_cver=1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKnm4UHgKcftNUdLDAWmO1o&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:472EAFCEE13948B5AAD5A88A32E34BD1

42 B
306 B

20ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:472EAFCEE13948B5AAD5A88A32E34BD1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 09:01:02 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Fri, 08 Jul 2022 20:17:40 GMT
x-content-type-options: nosniff
server: nginx
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:472EAFCEE13948B5AAD5A88A32E34BD1
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 07 Jul 2022 20:17:40 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2922852512061163556&gdpr=0&gdpr_consent=&us_privacy=

1 B
180 B

20ms
19ms

Image
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2922852512061163556&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2922852512061163556&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=70b3e8d7-cc97-480b-80ee-dad476c341d7

42 B
313 B

150ms
32ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=70b3e8d7-cc97-480b-80ee-dad476c341d7
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=70b3e8d7-cc97-480b-80ee-dad476c341d7
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2 200 E614708A-96BB-452C-8A92-C68CD106CB31
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 063F 43 B
993 B 108ms
27ms Image
image/gif 2600:1f18:4e9:5a02:357b:502f:f800:1eb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/E614708A-96BB-452C-8A92-C68CD106CB31?gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:357b:502f:f800:1eb Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=E614708A-96BB-452C-8A92-C68CD106CB31&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-0uyubopE2uWJDBz6y0D4cL6Gy5.wGGE-~A&gdpr=0&gdpr_consent=

0
128 B

463ms
82ms

Image
text/plain

104.36.113.24
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-0uyubopE2uWJDBz6y0D4cL6Gy5.wGGE-~A&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.113.24 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-0uyubopE2uWJDBz6y0D4cL6Gy5.wGGE-~A&gdpr=0&gdpr_consent=
date: Fri, 08 Jul 2022 20:17:40 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 063F 0
35 B 104ms
22ms Image
text/plain 54.146.231.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.231.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-231-30.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=048a94e9-fefb-11ec-a8b2-218c720e69f3&gdpr=0&gdpr_consent=

1 B
333 B

84ms
30ms

Image
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=048a94e9-fefb-11ec-a8b2-218c720e69f3&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 10:49:31 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=048a94e9-fefb-11ec-a8b2-218c720e69f3&gdpr=0&gdpr_consent=
Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 048a94ea-fefb-11ec-a8b2-218c720e69f3

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=E614708A-96BB-452C-8A92-C68CD106CB31&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=4aa792e3675f1229&is_secure=true&networkId=17100&version=1&nuid=E614708A-96BB-452C-8A92-C68CD106CB31&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGdGP8gG5u6gMq5ZDVAAAAAAA&expiration=1657397861&nuid=E614708A-96BB-452C-8A92-C68CD106CB31&...

42 B
345 B

20ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGdGP8gG5u6gMq5ZDVAAAAAAA&expiration=1657397861&nuid=E614708A-96BB-452C-8A92-C68CD106CB31&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 09:19:31 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGdGP8gG5u6gMq5ZDVAAAAAAA&expiration=1657397861&nuid=E614708A-96BB-452C-8A92-C68CD106CB31&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2840070346914927031&gdpr=0&gdpr_consent=

42 B
320 B

20ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2840070346914927031&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 10:00:47 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7728be68-2794-4ab4-adbb-df8de839f74b
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2840070346914927031&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=rXkDUaJ7BV22KFlar3pNXqN4WVi2c1kLr3mrieJC

42 B
498 B

24ms
23ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=rXkDUaJ7BV22KFlar3pNXqN4WVi2c1kLr3mrieJC
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=rXkDUaJ7BV22KFlar3pNXqN4WVi2c1kLr3mrieJC
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=

42 B
216 B

20ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=0&gdpr_consent=&gdpr_pd=
https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_7657d115-a7e5-4fe2-99e8-da204a2b12cb&bsw_param=254dd7d3-92b7-4826-982b-da30ccf966f8&expires=10
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=&gdpr_pd=

1 B
185 B

23ms
19ms

Image
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=&gdpr_pd=
Date: Fri, 08 Jul 2022 20:17:41 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 063F
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1D530_F2B5EE4C_75DB791D&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

60ms
60ms

Image
image/gif

38.67.14.233
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1

Protocol

HTTP/1.1

Server

38.67.14.233 , United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-340298261; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
Cache-Control: no-cache
Expires: -1
Content-Length: 43
Strict-Transport-Security: max-age=-340298261; includeSubDomains
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Fri, 08 Jul 2022 09:19:15 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7517899671563583421

42 B
219 B

19ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7517899671563583421
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7517899671563583421
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 063F
Redirect Chain

https://sync.resetdigital.co:10001/csync/pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=000000B90B871430

42 B
214 B

21ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=000000B90B871430
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Fri, 08 Jul 2022 20:17:59 GMT
Server: nginx/1.18.0 (Ubuntu)
Front-End-Https: on
Content-Type: text/html
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=000000B90B871430
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2EFC 6 KB
3 KB 60ms
20ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK merge
ce.lijit.com/ Frame 514F 43 B
2 KB 25ms
24ms Image
image/gif 23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=76&3pid=d64a6066-2d4b-0f88-0677-477242a43c62
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:40 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 514F
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8147514277513099876&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

41ms
40ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8147514277513099876&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8147514277513099876&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 514F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YsiQ5AAO0ntNvgAo

43 B
61 B

39ms
38ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YsiQ5AAO0ntNvgAo
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1657311461.833061,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YsiQ5AAO0ntNvgAo
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 2e63d8e2-5753-a7cc-701c-e721c542ce79
pr-bh.ybp.yahoo.com/sync/openx/ Frame 514F 43 B
992 B 32ms
27ms Image
image/gif 2600:1f18:4e9:5a02:357b:502f:f800:1eb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/2e63d8e2-5753-a7cc-701c-e721c542ce79?gdpr=0

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:357b:502f:f800:1eb Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 514F
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=baa4bea6-c7ff-3585-41cb-f1d43a150330&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=70b3e8d7-cc97-480b-80ee-dad476c341d7&ttd_puid=baa4bea6-c7ff-3585-41cb-f1d43a150330&gdpr=0&gdpr_consent=

43 B
62 B

41ms
40ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=70b3e8d7-cc97-480b-80ee-dad476c341d7&ttd_puid=baa4bea6-c7ff-3585-41cb-f1d43a150330&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=70b3e8d7-cc97-480b-80ee-dad476c341d7&ttd_puid=baa4bea6-c7ff-3585-41cb-f1d43a150330&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 335

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 514F 170 B
188 B 38ms
36ms Image
image/png 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTZjYjZkNmMtMGU4OC02YjIxLTU0MmItYWI2ZGYwZjdjZDUw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 514F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDzHTUI0cR-zFomuMCCpPlA&google_cver=1

43 B
61 B

39ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDzHTUI0cR-zFomuMCCpPlA&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDzHTUI0cR-zFomuMCCpPlA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 2EFC 4 KB
636 B 74ms
34ms Stylesheet
text/css 2607:f8b0:4006:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::200a New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 Jul 2022 18:56:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 08 Jul 2022 20:17:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 Jul 2022 20:17:40 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3D56 645 B
742 B 91ms
36ms Document
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNXiFnzTwKEuZ6F0eVkIDzmfXOcpYg44FyuodZkLc_8FQ5VBbLAulBg3PG-pEV4cBgkEiYrjINL2Mhr50axsju_nMMzDatamYfPpQL33RzWvkYvJPpk

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/ Frame 15D6 21 KB
8 KB 20ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/abg_lite_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 19:16:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3662
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 19:16:38 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/ Frame 15D6 6 KB
3 KB 21ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b175e3d672f1560352dc7df0b4e1aaf4cf6dba4605563465df69fcceb052bbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 12:32:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27896
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2628
x-xss-protection: 0
server: cafe
etag: 1103433747108554897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 12:32:44 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 15D6 41 KB
15 KB 33ms
29ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 18:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92758
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Jul 2023 18:31:42 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 15D6 3 KB
1 KB 34ms
30ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 15D6 137 KB
42 KB 90ms
47ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:40 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 15D6 17 KB
7 KB 34ms
30ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 15D6 0
0 89ms
38ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQlx5VQlSccaH2LkLh4xpwtkxPxuAMjhMqryn_zAIUZNn5UyEoyjeV3oX5DUFptnWzd18vAPmNl2cL056FBBaZoVtfrFw
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 15D6 42 B
63 B 50ms
46ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AmVg4VOEVykEGhMP4qwKdvpBrKn6_m-bWQSosc-B00RB7Da4w4nEWaIfKT0ulp15BbyYT5Qn-0QB3FMNIPx_cUDFYg3or6g6HOa0yNMLDa8_8WM6w

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/ Frame 2EFC 19 KB
8 KB 34ms
30ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae2e1dc0161fa05e80b225682868a9bfbab08c503b2429f06339d4487f160ac2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 17:04:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11579
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8263
x-xss-protection: 0
server: cafe
etag: 17157773748623750166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 17:04:41 GMT

GET
H2 200 176838570921095027
s0.2mdn.net/simgad/ Frame 15D6 63 KB
64 KB 96ms
22ms Image
image/png 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/176838570921095027

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c99bee74aefc77081cf112204158705bbaf711b1cd30d5942ba97ba77da8182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 04:31:51 GMT
x-content-type-options: nosniff
age: 575149
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64740
x-xss-protection: 0
last-modified: Thu, 02 Jun 2022 19:10:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jul 2023 04:31:51 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 82ms
41ms Script
application/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=xmod.in

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 118ms
39ms Script
application/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=xmod.in

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 33 KB
15 KB 697ms
697ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.in_728x90_ATF_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=2&adks=740958930&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460929&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=436&adys=577&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1556x36&msz=728x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c15ece93add7f82f1cd3b7d61de7fb27b42d47315035e588b855f3bcdb0316d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14852
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
15 KB 1735ms
1733ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.in_728x90_ATF_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=3&adks=1220607417&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460934&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=436&adys=602&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x777&msz=728x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

debf81772532301a6b7cb351dd2fbfd6b9f72241fb98c5c95886abb1a49fde24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15328
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 435 B
260 B 1974ms
1972ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.com_300x600_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&ifi=4&adks=2867371895&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460937&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=650&adys=577&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1556x36&msz=300x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34125db55b1524328225c2a2aa3843052eceff77654a506327ec934f9f0ca068

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 224
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
15 KB 514ms
512ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.in_300x250_BTF_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=5&adks=2987326668&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460941&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=650&adys=661&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x777&msz=300x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3322efbc59f91be2cd09e4e8286bfd86bf6f161c26f0abc2fae31fedb9e25adf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15081
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
15 KB 1322ms
1321ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.com_300x250_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=6&adks=527204189&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460945&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=650&adys=96&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x777&msz=300x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9191f456835ee5952b2752db3087e7f7c1b0f96162966578b9ef0565f2dc41e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15070
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
34 KB 1134ms
1132ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.com_300x250_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=7&adks=1581293923&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460949&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=650&adys=96&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x777&msz=300x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f16890459dc9188258fbbde7da8dd68612806ad6ca8bfbef311210bb00e3cf0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34548
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
15 KB 2402ms
2401ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.com_300x250_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=8&adks=1921342282&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460952&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=650&adys=288&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x506&msz=300x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22f4627e86e5709b189cf52338b410c76a10ebba62eb5a546965725c9330b86e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15258
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 435 B
266 B 2583ms
2582ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3338952388759136&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=110220698%3A22679756903%2Cxmod.com_300x250_DK&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=9&adks=1464480809&sfv=1-0-38&ecs=20220708&fsapi=false&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311460993&lmt=1657311460&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=650&adys=405&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x506&msz=300x0&fws=132&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abfe7292062937d06217589207aa4251c843e139d57e29b43258273559031081

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 226
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 899.json Show response
id5-sync.com/g/v2/ 454 B
1 KB 306ms
98ms XHR
application/json 141.95.98.71
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/899.json

Requested by

Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.71 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

aadde0cb5153768a09c896b2f4dedf077864edd9bb1a936de7f32c0aca848ee3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:40 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
p3p: CP="CAO PSA OUR"
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8
transfer-encoding: chunked

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame FB0D 1 KB
994 B 581ms
113ms Document
text/html 23.227.146.66
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.146.66 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 8a77716d191bdcbb71ccafbe17e67b9e6f45d58e3c7477e3c9b7d7b9321c6f5a

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://xmod.in
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 699
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H/1.1

200
OK

csync Show response
sync.adtelligent.com/ Frame 4ABA
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D584890%26extuid%3D%24UID
https://sync.adtelligent.com/csync?t=a&ep=584890&extuid=2840070346914927031

0
390 B

97ms
18ms

Document
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=584890&extuid=2840070346914927031
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:40 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

Redirect headers

AN-X-Request-Uuid: c1b526be-2034-438f-b351-c647d90e324d
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Fri, 08 Jul 2022 20:17:41 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://sync.adtelligent.com/csync?t=a&ep=584890&extuid=2840070346914927031
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H2 200 / Show response
csync.smilewanted.com/ Frame 28C3 6 KB
2 KB 145ms
120ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 459bbb4f20da99d4483ee081a401d40d810393099db5381b92e91c33b9d2cd39

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b81380fdce6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6984 2 KB
814 B 11ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=59a18369e249bfb

Requested by

Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

csync Show response
sync.adtelligent.com/ Frame A010
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D319130%26extuid%3D%7Bdevice_id%7D
https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=c200cde8-8ecd-4daa-bb36-66df8263fbd7

0
407 B

18ms
18ms

Document
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=c200cde8-8ecd-4daa-bb36-66df8263fbd7
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:40 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 727b81381b1fecf6-YUL
content-length: 0
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=c200cde8-8ecd-4daa-bb36-66df8263fbd7
server: cloudflare

GET
H2

200

/ Show response
ads.us.e-planning.net/uspd/1/ Frame 339A
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

2 KB
1 KB

31ms
30ms

Document
text/html

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 803d7aa8a40bdcf15505d1810c9b386191adec3897b1d009f31012403a70bf79

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
expires: Fri, 08 Jul 2022 20:17:41 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1219

Redirect headers

content-type: text/html; charset=iso-8859-1
date: Fri, 08 Jul 2022 20:17:41 GMT
location: /uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1219

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame D8AB 2 KB
930 B 11ms
11ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?redir=https%3a%2f%2flwgadm.com%2fusermatch%2fpl%3fcb%3d637929082601817677%26bid%3d08d9af6e-a576-4661-84a3-a194f4d4c613%26lwuid%3df7feaf7058744afc86d69c6c50426a3b%26buid%3d${USER_TOKEN}

Requested by

Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Resource Hash

32e16481359272cbec03a1564f72a6cc1c2b453aa5938206d1469d15657428ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 847
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B400 52 KB
17 KB 103ms
20ms Document
text/html 23.221.202.212
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.202.212 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-202-212.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 08 Jul 2022 20:17:41 GMT
ETag: "623de86a-cf34"
Expires: Sat, 09 Jul 2022 20:17:43 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 6007 15 KB
6 KB 25ms
19ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr={gdpr]&gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D558003%26extuid%3D

Requested by

Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52838
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2

400

/ Show response
de.tynt.com/deb/ Frame AFE1
Redirect Chain

https://ic.tynt.com/r/d?m=xch&rt=html&gdpr={gdpr}gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
https://de.tynt.com/deb/?m=xch&rt=html&gdpr={gdpr}gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X

2 KB
2 KB

96ms
31ms

Document
text/html

67.202.105.32
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr={gdpr}gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.32 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip32.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 1e7a6268c092f32f8f1c8bce2756abec6a049c7f010657f40f4c35290664b652

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-language: en
content-length: 2321
content-type: text/html;charset=utf-8
date: Fri, 08 Jul 2022 20:17:41 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
content-length: 171
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
location: https://de.tynt.com/deb/?m=xch&rt=html&gdpr={gdpr}gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
p3p: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID" CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
server: nginx/1.16.1

GET
H/1.1 200
OK sync.html Show response
s.adtelligent.com/ Frame 6BE3 3 KB
2 KB 510ms
312ms Document
text/html 2a06:8640:506:0:ec4:7aff:fec2:7e6e
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adtelligent.com/sync.html?aid=656378
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:8640:506:0:ec4:7aff:fec2:7e6e Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 92a79c393194fce177e2041e07ff1e0df5e208e046eb273f943f7b9a96288158

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://xmod.in
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1281
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H/1.1 200
OK sync.html Show response
s.adtelligent.com/ Frame 258F 1 KB
1 KB 508ms
312ms Document
text/html 2a06:8640:506:0:ec4:7aff:fec2:7e6e
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adtelligent.com/sync.html?aid=651796
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:8640:506:0:ec4:7aff:fec2:7e6e Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 9c79af78cb324a3ca6c879d38313c4eb4025972decd05170d88f4b486f43acef

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://xmod.in
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 783
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:40 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H2

200

pl
lwgadm.com/usermatch/
Redirect Chain

https://ib.adnxs.com/getuid?https%3a%2f%2flwgadm.com%2fusermatch%2fpl%3fcb%3d637929082601817677%26bid%3d03485854-5ae2-43d5-8d5d-cfe9b12ac08c%26lwuid%3df7feaf7058744afc86d69c6c50426a3b%26buid%3d$UID
https://lwgadm.com/usermatch/pl?cb=637929082601817677&bid=03485854-5ae2-43d5-8d5d-cfe9b12ac08c&lwuid=f7feaf7058744afc86d69c6c50426a3b&buid=2840070346914927031

70 B
474 B

100ms
100ms

Image
image/gif

18.185.189.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lwgadm.com/usermatch/pl?cb=637929082601817677&bid=03485854-5ae2-43d5-8d5d-cfe9b12ac08c&lwuid=f7feaf7058744afc86d69c6c50426a3b&buid=2840070346914927031
Protocol: H2
Server: 18.185.189.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-189-177.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-cache,no-store,max-age=0,must-revalidate,private
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 70
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8b5091a3-4089-465b-a823-e679368c048e
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://lwgadm.com/usermatch/pl?cb=637929082601817677&bid=03485854-5ae2-43d5-8d5d-cfe9b12ac08c&lwuid=f7feaf7058744afc86d69c6c50426a3b&buid=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

yahoo
prebid.a-mo.net/setuid/
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=&us_privacy=&cb=https%3a%2f%2flwgadm.com%2fusermatch%2fpl%3fcb%3d637929082601817677%26bid%3d094c0db2-5ca2-43f2-be9b-500255dd1cfd%26lwuid%3df7feaf7058744afc86d6...
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F26%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D215a8651-2d31-4ce5-9bb1-ee23d0d65937%26bidder%3Dappnexus%26cbx%3DaHR0cH...
https://prebid.a-mo.net/cchain/0/26?gdpr=&gdpr_consent=&us_privacy=&A=215a8651-2d31-4ce5-9bb1-ee23d0d65937&bidder=appnexus&cbx=aHR0cHM6Ly9sd2dhZG0uY29tL3VzZXJtYXRjaC9wbD9jYj02Mzc5MjkwODI2MDE4MTc2Nz...
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F1%2F26%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D215a8651-2...
https://prebid.a-mo.net/cchain/1/26?gdpr=&gdpr_consent=&us_privacy=&A=215a8651-2d31-4ce5-9bb1-ee23d0d65937&bidder=index_rtb&cbx=aHR0cHM6Ly9sd2dhZG0uY29tL3VzZXJtYXRjaC9wbD9jYj02Mzc5MjkwODI2MDE4MTc2N...
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F26%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D215a8651-2d31-4ce5-9bb1-ee23d0d65...
https://prebid.a-mo.net/cchain/2/26?gdpr=&gdpr_consent=&us_privacy=&A=215a8651-2d31-4ce5-9bb1-ee23d0d65937&bidder=sovrn&cbx=aHR0cHM6Ly9sd2dhZG0uY29tL3VzZXJtYXRjaC9wbD9jYj02Mzc5MjkwODI2MDE4MTc2NzcmY...
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....
https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=2840070346914927031
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F4%2F26%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D215a8651-2d31-4ce5-9bb1-ee23d0d65937%26...
https://prebid.a-mo.net/cchain/4/26?gdpr=&gdpr_consent=&us_privacy=&A=215a8651-2d31-4ce5-9bb1-ee23d0d65937&bidder=pubmatic&cbx=aHR0cHM6Ly9sd2dhZG0uY29tL3VzZXJtYXRjaC9wbD9jYj02Mzc5MjkwODI2MDE4MTc2Nz...
https://cm.adform.net/cookie?gdpr=0&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F26%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D215a8651-2d31-4ce5-9bb1-ee23d0d65937...
https://prebid.a-mo.net/cchain/5/26?gdpr=&gdpr_consent=&us_privacy=&A=215a8651-2d31-4ce5-9bb1-ee23d0d65937&bidder=adform&cbx=aHR0cHM6Ly9sd2dhZG0uY29tL3VzZXJtYXRjaC9wbD9jYj02Mzc5MjkwODI2MDE4MTc2Nzcm...
https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=215a8651-2d31-4ce5-9bb1-ee23d0d65937
https://prebid.a-mo.net/setuid/yahoo?uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A&gdpr=0&gdpr_consent=

0
124 B

26ms
25ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A&gdpr=0&gdpr_consent=
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A&gdpr=0&gdpr_consent=
date: Fri, 08 Jul 2022 20:17:43 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4F64 0
0 64ms
63ms Image
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022063001&jk=2642823349036530&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
34 KB 400ms
399ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3078761614069417&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=23081961%3A22650038596%2Cxmod_art_desk_header&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=10&adks=3430524534&sfv=1-0-38&ecs=20220708&fsapi=false&prev_scp=m2_pageview%3D11096-220518-fa2%25400%26m2_session%3D11096-220518-fa2%25400%26m2_config%3D11096-220518-fa2%25400%26m2_stack%3Denabled%2Cgb%26m2_cohort%3D1%253A2206221614%253A220518-fa2%253A11096%253A0.45%26m2_tc%3Dtc-init%26m2_pid%3Doftmedia%252Fp%253A24736605%26m2_bidder%3Doftmedia%26m2_size%3D728x90%26m2_adid%3D734643d6c27678e%26m2_pb%3D0.04%26m2_canonical%3D08cd7fc63fd46f393a7dd9546189584d%26m2_canonical_session%3D08cd7fc63fd46f393a7dd9546189584d%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311461162&lmt=1657311461&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=436&adys=602&ucis=a&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x777&msz=1600x0&fws=4&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ca663a1a783767882482a403dee6eea2c839f1814c4a8ee0e52976039037e4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34711
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
34 KB 356ms
355ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=787114035677423&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=23081961%3A22650038596%2Cxmod_art_desk_mid&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280&ifi=11&adks=3331753794&sfv=1-0-38&ecs=20220708&fsapi=false&prev_scp=m2_config%3D11096-220518-fa2%25400%26m2_stack%3Denabled%2Cgb%26m2_cohort%3D1%253A2206221614%253A220518-fa2%253A11096%253A0.45%26m2_tc%3Dtc-init%26m2_pid%3Dappnexus%252Fp%253A24850726%26m2_bidder%3Dappnexus%26m2_size%3D300x250%26m2_adid%3D807126b7dfba947%26m2_pb%3D0.10%26m2_canonical%3D08cd7fc63fd46f393a7dd9546189584d%26m2_canonical_session%3D08cd7fc63fd46f393a7dd9546189584d%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311461165&lmt=1657311461&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=650&adys=288&ucis=b&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x0&msz=1600x0&fws=4&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46fbed4888953e177f1b58e4b6aa33766b23f6a8d564ca129411b4ec7b849723

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34394
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
34 KB 488ms
488ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2642823349036530&correlator=3505459542645835&eid=31068034%2C31068337%2C44768338%2C31068364%2C42531607%2C31062931&output=ldjh&gdfp_req=1&vrg=2022063001&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=23081961%3A22650038596%2Cxmod_art_desk_anchor&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C1x1&ifi=12&adks=2788197179&sfv=1-0-38&ecs=20220708&fsapi=false&prev_scp=m2_config%3D11096-220518-fa2%25400%26m2_stack%3Denabled%26m2_cohort%3D1%253A2206221614%253A220518-fa2%253A11096%253A0.45%26m2_tc%3Dtc-init%26m2_canonical%3D08cd7fc63fd46f393a7dd9546189584d%26m2_canonical_session%3D08cd7fc63fd46f393a7dd9546189584d%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F&eri=1&sc=1&cookie=ID%3Df4f509ab68429776-2282fb53757c00af%3AT%3D1657311460%3AS%3DALNI_Ma2DIKstvpkx-0kmiEvv5meGV-Cxg&gpic=UID%3D00000748e07fee74%3AT%3D1657311460%3ART%3D1657311460%3AS%3DALNI_MZkt8JLR4Nzz_uHglgz3JBuuKcG1Q&abxe=1&dt=1657311461168&lmt=1657311461&dlt=1657311459125&idt=840&biw=1600&bih=1200&adxs=0&adys=1510&ucis=c&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fxmod.in%2Fblog%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x777&msz=728x-1&fws=516&ohw=1600&ga_vid=31954185.1657311459&ga_sid=1657311460&ga_hid=770887253&ga_fc=true&btvi=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fbe99fff0366342a81a0802099b1b9326d98fd558858a97b2b8260b0ed47720f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34635
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3D56
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFGpXFrUxEBAOlxx0WKDdJg&google_cver=1&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFGpXFrUxEBAOlxx0WKDdJg&google_cver=1&gdpr=0&C=1

43 B
910 B

66ms
61ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFGpXFrUxEBAOlxx0WKDdJg&google_cver=1&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNXiFnzTwKEuZ6F0eVkIDzmfXOcpYg44FyuodZkLc_8FQ5VBbLAulBg3PG-pEV4cBgkEiYrjINL2Mhr50axsju_nMMzDatamYfPpQL33RzWvkYvJPpk
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8139b92ca23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jS1NDFxTFy56HIoh6Fxeie%2B9Fcw6l4fYtGqDbwURuyX55k4Dy8pCeJlihRF4jxxU2hHjNrMI2G5%2F%2FXV0wyOIWCivOnYP24T%2FXoqUpSg05AXlCD3fmVW%2F8swzU7CMVUsJxWgSZjVUFjFNSA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eVvCyrSSex5SU01TZ7WyTYdpssYzdzaBP7mi9xdHS%2FtKkXQKa30eMgkfCB4V5zh4Var2JMeYBN5Ch99TN7tRYo86gyW4mP6sCjpR9xYpD3ee0UDFle2fHGiNgF93GWciARYNVKzxD%2FEvcw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEFGpXFrUxEBAOlxx0WKDdJg&google_cver=1&gdpr=0&C=1
cache-control: no-cache
cf-ray: 727b81392e0654b5-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3D56
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YsiQ5QpkrhWTB2VNAb45aAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFGpXFrUxEBAOlxx0WKDdJg&google_cver=1

43 B
902 B

52ms
52ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFGpXFrUxEBAOlxx0WKDdJg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNXiFnzTwKEuZ6F0eVkIDzmfXOcpYg44FyuodZkLc_8FQ5VBbLAulBg3PG-pEV4cBgkEiYrjINL2Mhr50axsju_nMMzDatamYfPpQL33RzWvkYvJPpk
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b813a9a16a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JBo9Q7ateDMZMS7S0nVHwEG5gIintfREjk71EXMttjIZEU81%2Fc1hlvaj6tla1rLQKtFQmhx992H2pBhl0jAfmucgIhwLiglUU495mTuPJvqBVpCjsyVVlyT8orVF8%2FF26ANz0TO9cRxfmg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFGpXFrUxEBAOlxx0WKDdJg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3D56
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEE42nHnDpfbBj5xzoACGTgM&google_cver=1

43 B
1018 B

250ms
250ms

Image
image/gif

68.67.160.134
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEE42nHnDpfbBj5xzoACGTgM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNXiFnzTwKEuZ6F0eVkIDzmfXOcpYg44FyuodZkLc_8FQ5VBbLAulBg3PG-pEV4cBgkEiYrjINL2Mhr50axsju_nMMzDatamYfPpQL33RzWvkYvJPpk

Protocol

HTTP/1.1

Server

68.67.160.134 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7a59deab-9693-47a9-b239-4bb39b5e653a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEE42nHnDpfbBj5xzoACGTgM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D56
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg0MDA3MDM0NjkxNDkyNzAzMQ%3D%3D

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg0MDA3MDM0NjkxNDkyNzAzMQ%3D%3D

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2539531b-3326-4676-a240-120e8030dfed
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg0MDA3MDM0NjkxNDkyNzAzMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C30 36 KB
14 KB 20ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

3c12f2da086c2408f3f1255b457b7798f793cf77f792c14c66fdbb9bf3c3eaa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 19:02:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 177327
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13888
x-xss-protection: 0
last-modified: Fri, 01 Jul 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 06 Jul 2023 19:02:14 GMT

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame 339A
Redirect Chain

https://pixel.sitescout.com/dmp/pixelSync?network=EPLANNING&rurl=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fuid%3D%7BUSER_ID%7D%26dc%3D0abbcb4eba840e59%26fi%3D43c40cadbd39e3cd
https://tags.bluekai.com/site/17724?id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D1389%26tp%3DSTSC%26tpid%3Da5a15de6-7a9e-443f-9e10-d2321...
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fuid%3Da5a15de6-7a9e-443...

49 B
264 B

94ms
31ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fuid%3Da5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341%26dc%3D0abbcb4eba840e59%26fi%3D43c40cadbd39e3cd
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.3.92
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

location: https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fuid%3Da5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341%26dc%3D0abbcb4eba840e59%26fi%3D43c40cadbd39e3cd
date: Fri, 08 Jul 2022 20:17:41 GMT
content-length: 0
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2

200

um
sync.e-planning.net/ Frame 339A
Redirect Chain

https://sync.1rx.io/usersync2/eplanning
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005&rndcb=2351038770
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=254dd7d3-92b7-4826-982b-da30ccf966f8&google_hm=MjU0ZGQ3ZDMtOTJiNy00ODI2LTk4MmItZGEzMGNjZjk2...
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEDbyGXcF0_ypRLZk4fDarQw&google_cver=1&ssp=adconductor&bsw_param=254dd7d3-92b7-4826-982b-da30ccf966f8
https://sync.1rx.io/usersync/bidswitch/254dd7d3-92b7-4826-982b-da30ccf966f8?gdpr=&gdpr_consent=
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3DRX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005%26dc%3D1079...
https://sync.e-planning.net/um?uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005&dc=1079cc634ca638f8&iss=1

42 B
103 B

34ms
24ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005&dc=1079cc634ca638f8&iss=1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
server: openresty
content-type: image/gif

Redirect headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Tengine
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://sync.e-planning.net/um?uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005&dc=1079cc634ca638f8&iss=1
Connection: keep-alive
Content-Type: text/html

GET
H2

200

um
u-iad04.e-planning.net/ Frame 339A
Redirect Chain

https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeebd%26fi%3D43c40cadbd39e3cd%26uid%3D%24%7BUID%7D
https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=43c40cadbd39e3cd&uid=837a3169-7e60-066c-2a47-31c1bb4ec1bd

42 B
103 B

90ms
66ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=43c40cadbd39e3cd&uid=837a3169-7e60-066c-2a47-31c1bb4ec1bd
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
server: openresty
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=43c40cadbd39e3cd&uid=837a3169-7e60-066c-2a47-31c1bb4ec1bd
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: j7et7j696befca13rl4dhic2sd68t8l2

GET
H/1.1 200 ptag Show response
a.audrte.com/ Frame 339A 5 KB
2 KB 119ms
25ms Script
text/plain 54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptag?p=M1353665098
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: bd8ccf8e3f2a53ec9bdbd3582a0a03bb9110fc4b3ad7586c05974cb2af42a953

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-transform, public, max-age=3600
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1682

GET
H2 200 lotame20220615.js Show response
s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/ Frame 339A 566 B
521 B 92ms
25ms Script
application/x-javascript 172.98.26.121
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.121 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 4f618d20d85f3163d72432606f3afa3c17b6c79954f967ec3df9a710503c9df4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
last-modified: Wed, 15 Jun 2022 16:21:31 GMT
server: openresty
etag: W/"62aa070b-236"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Wed, 07 Jul 2027 20:17:41 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 339A
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3D43c40cadbd39e3cd%26uid%3D%24UID
https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=43c40cadbd39e3cd&uid=2840070346914927031

42 B
104 B

83ms
21ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=43c40cadbd39e3cd&uid=2840070346914927031
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
server: openresty
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 08c31d12-839d-4a05-97d9-ece23a6bceaf
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=43c40cadbd39e3cd&uid=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 339A
Redirect Chain

https://sync.go.sonobi.com/us?loc=%0A%0Ahttps%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3De52415579699e09f%26fi%3D43c40cadbd39e3cd%26uid%3D%5BUID%5D
https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=43c40cadbd39e3cd&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4

42 B
103 B

66ms
66ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=43c40cadbd39e3cd&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
server: openresty
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-117
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=43c40cadbd39e3cd&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 339A
Redirect Chain

https://cs.emxdgt.com/um?ssp=pbs&gdpr=0&gdpr_consent={{.GDPRConsent}}&us_privacy={{.USPrivacy}}&redirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dd87251d0debad578%26fi%3D43c40cadbd39e3cd%26...
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dd87251d0debad578%26fi%3D43c40cadbd39e3cd%26uid%3D%24EMXUID&b64_redire...
https://cs.emxdgt.com/umcheck?apnxid=2840070346914927031&redirect=https://u-iad04.e-planning.net/um?dc=d87251d0debad578&fi=43c40cadbd39e3cd&uid=$EMXUID&b64_redirect=aHR0cHM6Ly91LWlhZDA0LmUtcGxhbm5p...
https://u-iad04.e-planning.net/um?dc=d87251d0debad578&fi=43c40cadbd39e3cd&uid=2840070346914927031brt64371657311461469722af

42 B
103 B

22ms
22ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=d87251d0debad578&fi=43c40cadbd39e3cd&uid=2840070346914927031brt64371657311461469722af
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
server: openresty
content-type: image/gif

Redirect headers

location: https://u-iad04.e-planning.net/um?dc=d87251d0debad578&fi=43c40cadbd39e3cd&uid=2840070346914927031brt64371657311461469722af
date: Fri, 08 Jul 2022 20:17:41 GMT
content-length: 0
content-type: text/html

GET
H2 200 pl
lwgadm.com/usermatch/ Frame D8AB 70 B
515 B 100ms
100ms Image
image/gif 18.185.189.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lwgadm.com/usermatch/pl?cb=637929082601817677&bid=08d9af6e-a576-4661-84a3-a194f4d4c613&lwuid=f7feaf7058744afc86d69c6c50426a3b&buid=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?redir=https%3a%2f%2flwgadm.com%2fusermatch%2fpl%3fcb%3d637929082601817677%26bid%3d08d9af6e-a576-4661-84a3-a194f4d4c613%26lwuid%3df7feaf7058744afc86d69c6c50426a3b%26buid%3d${USER_TOKEN}
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.189.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-189-177.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
cache-control: no-cache,no-store,max-age=0,must-revalidate,private
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 70
content-type: image/gif

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9CFC 22 KB
8 KB 21ms
21ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 92721
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Jul 2022 18:32:20 GMT
expires: Fri, 07 Jul 2023 18:32:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame BF8C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=eplanning_east&endpoint=us-east
https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east

281 B
554 B

72ms
18ms

Document
text/html

23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:41 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 08 Jul 2022 20:17:41 GMT
location: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 5850 15 KB
6 KB 21ms
20ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D43c40cadbd39e3cd%26uid%3D

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52838
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 usermatch Show response
ssum.casalemedia.com/ Frame DAF0 1 KB
1 KB 123ms
63ms Document
text/html 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e10e81ebb3be781790a3628d1a42905d3ee476033d4119cb592604dfe0e80f2

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 727b813a0f085401-YYZ
content-encoding: br
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
dropped-udsids: 39|241|230|73|41|123|51|5
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E8jj1kwQR0syySJ9%2BWPfo0yD8biq3Wgn5UDOyluBvhvGK5mkIZ1qgzMjOryRYnVmSHk%2FJLWHPhqZEMYN%2Bue7fz52uT8HiD4eq7gS4nO1HcIhL2MWp7Y1RyYcSG%2B2jeZKXrp1AYlQ"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

GET
H2 200 navegg_2022_01_br.html Show response
i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/ Frame E5D7 1 KB
987 B 369ms
113ms Document
text/html 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/navegg_2022_01_br.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 Leesburg, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: fda04c7b27b3db6bda165e1d1324e7c475edc1f3cc06e927a78f739d74992fcb

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=157680000
cf4age: 0
cf4ttl: 157680000.000
content-encoding: gzip
content-length: 624
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
etag: W/"61ddbb71-5f5"
expires: Mon, 21 Jun 2027 11:13:51 GMT
last-modified: Tue, 11 Jan 2022 17:16:33 GMT
server: CFS 0215
x-cf-rand: 20.214
x-cf-tsc: 1655896432
x-cf1: 29080:dB.waw1:co:1585621119:cacheN.waw1-01:D
x-cf2: H
x-cf3: M
x-cff: B

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 1896 2 KB
814 B 11ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5927d926323dc2c

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 204 /
spl.zeotap.com/ Frame 8FC8 0
0 90ms
54ms Document
text/plain 2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 727b8139ec334bb9-YUL
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
via: 1.1 google

GET
H3 200 ad_companion Show response
fundingchoicesmessages.google.com/f/AGSKWxW3AFCx1SgfS06uS6klJMpHqC-_HQl7PSs976hFenCRQRsOJh3j-q_zcXTDc_5Qdv_tzDrR5FuimUPXAxTZ4kI7Urx9wVPVMRLIthbfxgLRlacLxr8ZdxDOGccHy3m4cCW2AtWsfGuyQHYmyviUM-lHX6mXe... 54 B
109 B 43ms
42ms Script
application/javascript 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW3AFCx1SgfS06uS6klJMpHqC-_HQl7PSs976hFenCRQRsOJh3j-q_zcXTDc_5Qdv_tzDrR5FuimUPXAxTZ4kI7Urx9wVPVMRLIthbfxgLRlacLxr8ZdxDOGccHy3m4cCW2AtWsfGuyQHYmyviUM-lHX6mXeFETZL9KpNIRrb8oqqigLDUMUP3-cz5MYKnNlVf7NcGRNRcufFBHRPv2lr1fBiY-GbBXe5vF7MMJp0bneGA=/_/mpu-dm.htm/ad_companion?/yahoofeedproxy./ads/ad./fuckadblock.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

388877a97947d053b3485aadb5861eb53855373f90e7ef4c9b1ac287f2d08e60

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0lePCYK8eV4JfS-4QS6nNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-0lePCYK8eV4JfS-4QS6nNw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-0lePCYK8eV4JfS-4QS6nNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-0lePCYK8eV4JfS-4QS6nNw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 80 KB
29 KB 20ms
19ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcad0b2d7653e6c3deb49ba56db4266430fc9f60242c2dca758bd33ec1225afe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 19:38:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2359
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30004
x-xss-protection: 0
server: cafe
etag: 14763935573196537259
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 08 Jul 2022 20:38:22 GMT

POST
H3 204 AGSKWxWv-nx5acIIPKlABRGfxZ24BDwylAIAq7EsuONj67fibI-yiWtG36d7an_f66v9CuKqcy1aBS4i1tw4pYhP9tl4oFCva5XG0nbS8HaWDxBQGDkT-MJKMJlHltIf1Jwis93yG8sIq8EzQwzd5jb9Gb6mFpP5NLZ9RMnZ8akZwYDWjfqs6lO1QJ-4Or_Z Show response
fundingchoicesmessages.google.com/el/ 0
28 B 45ms
45ms XHR
text/html 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eS97gHyTdWjB1Rp9PvAynw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-eS97gHyTdWjB1Rp9PvAynw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://xmod.in
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-eS97gHyTdWjB1Rp9PvAynw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-eS97gHyTdWjB1Rp9PvAynw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 decode_consent.js Show response
static.smilewanted.com/js/decode_consent/ Frame 28C3 48 KB
12 KB 60ms
51ms Script
application/javascript 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.smilewanted.com/js/decode_consent/decode_consent.js

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://csync.smilewanted.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 720596
vary: Accept-Encoding
x-xss-protection: 1; mode=block
referrer-policy: strict-origin
last-modified: Thu, 15 Apr 2021 17:11:55 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"607873db-c1ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 727b813a09a7e6e0-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 10 Show response
lwgadm.com/analytics/ 0
277 B 537ms
340ms XHR
text/plain 18.185.189.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lwgadm.com/analytics/10
Requested by: Host: content.lwgadm.com
URL: https://content.lwgadm.com/hop/6.22.1/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.189.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-189-177.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://xmod.in
cache-control: no-cache,no-store,max-age=0,must-revalidate,private
access-control-allow-credentials: true

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame B400 0
745 B 18ms
17ms Script
text/html 68.67.160.134
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.134 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9e5d5165-8e68-4deb-b493-bb9b877de175
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 AGSKWxWv-nx5acIIPKlABRGfxZ24BDwylAIAq7EsuONj67fibI-yiWtG36d7an_f66v9CuKqcy1aBS4i1tw4pYhP9tl4oFCva5XG0nbS8HaWDxBQGDkT-MJKMJlHltIf1Jwis93yG8sIq8EzQwzd5jb9Gb6mFpP5NLZ9RMnZ8akZwYDWjfqs6lO1QJ-4Or_Z Show response
fundingchoicesmessages.google.com/el/ 0
29 B 51ms
49ms XHR
text/html 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3BODEGKGUTVsaS8NdKrU2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-3BODEGKGUTVsaS8NdKrU2A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: https://xmod.in
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-3BODEGKGUTVsaS8NdKrU2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-3BODEGKGUTVsaS8NdKrU2A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js Show response
pagead2.googlesyndication.com/bg/ Frame 9CFC 36 KB
14 KB 22ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c12f2da086c2408f3f1255b457b7798f793cf77f792c14c66fdbb9bf3c3eaa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 19:02:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 177327
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13888
x-xss-protection: 0
last-modified: Fri, 01 Jul 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 06 Jul 2023 19:02:14 GMT

POST
H3 204 AGSKWxWv-nx5acIIPKlABRGfxZ24BDwylAIAq7EsuONj67fibI-yiWtG36d7an_f66v9CuKqcy1aBS4i1tw4pYhP9tl4oFCva5XG0nbS8HaWDxBQGDkT-MJKMJlHltIf1Jwis93yG8sIq8EzQwzd5jb9Gb6mFpP5NLZ9RMnZ8akZwYDWjfqs6lO1QJ-4Or_Z Show response
fundingchoicesmessages.google.com/el/ 0
28 B 46ms
46ms XHR
text/html 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Z5A0oZ-W10GiD76LoZl-MQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-Z5A0oZ-W10GiD76LoZl-MQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://xmod.in
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-Z5A0oZ-W10GiD76LoZl-MQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-Z5A0oZ-W10GiD76LoZl-MQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUrOyY7XhVlHC3ZgXspTw7J5sVyetRVtk9ZPySP5FhC5y1c-CZoepquUXtS-EDV7mMX0pXi4As_DOl6BDGuedjgv6Bg15A6kdQeUS1-pbaR8IjyPLYdt_YdVvlllxTBq6IQM_uguBR3CvywYoMLP0NyW2Yo1qN7ATVJmBEEiZpcjnSXpwxPLKrdQYnt Show response
fundingchoicesmessages.google.com/f/ 59 KB
22 KB 75ms
75ms Script
application/javascript 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUrOyY7XhVlHC3ZgXspTw7J5sVyetRVtk9ZPySP5FhC5y1c-CZoepquUXtS-EDV7mMX0pXi4As_DOl6BDGuedjgv6Bg15A6kdQeUS1-pbaR8IjyPLYdt_YdVvlllxTBq6IQM_uguBR3CvywYoMLP0NyW2Yo1qN7ATVJmBEEiZpcjnSXpwxPLKrdQYnt?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjU3MzExNDYxLDUwNjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8veG1vZC5pbi9ibG9nLyIsbnVsbCxbXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f58b23b83505fb0744d2a131e7da53790e3457ffda0c3680e49ec151314f074a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-bztPArtDsaoB06xejDgd9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-bztPArtDsaoB06xejDgd9A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-bztPArtDsaoB06xejDgd9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-bztPArtDsaoB06xejDgd9A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWv-nx5acIIPKlABRGfxZ24BDwylAIAq7EsuONj67fibI-yiWtG36d7an_f66v9CuKqcy1aBS4i1tw4pYhP9tl4oFCva5XG0nbS8HaWDxBQGDkT-MJKMJlHltIf1Jwis93yG8sIq8EzQwzd5jb9Gb6mFpP5NLZ9RMnZ8akZwYDWjfqs6lO1QJ-4Or_Z Show response
fundingchoicesmessages.google.com/el/ 0
29 B 48ms
47ms XHR
text/html 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fJr7_YMgnGWc2kXyQjrg_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-fJr7_YMgnGWc2kXyQjrg_g' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: https://xmod.in
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-fJr7_YMgnGWc2kXyQjrg_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-fJr7_YMgnGWc2kXyQjrg_g' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 69AF 6 KB
3 KB 19ms
18ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 lt.min.js Show response
tags.crwdcntrl.net/lt/c/15238/ Frame 339A 47 KB
15 KB 74ms
20ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Requested by: Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 074691f1175a4040f292124afbff0c87cd24290b7b9672577f33b7c7de205384

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 08 Jul 2022 19:04:01 GMT
content-encoding: gzip
last-modified: Wed, 15 Jun 2022 17:05:13 GMT
server: AmazonS3
age: 4421
etag: W/"a31a707739fd82541fa40e577dbbfede"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
cache-control: max-age: 86400
x-amz-cf-pop: JFK50-P4
x-amz-cf-id: LYOo1tXpXtZUho3ek2moVGE4ALoZx5HpP1FiH_fUAIqfhreSlG8Oxg==

GET
H2 200 sirdata_03022021.html Show response
s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/ Frame 4512 636 B
577 B 22ms
22ms Document
text/html 172.98.26.121
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.121 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=157680000
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
etag: W/"601b131c-27c"
expires: Wed, 07 Jul 2027 20:17:41 GMT
last-modified: Wed, 03 Feb 2021 21:18:20 GMT
server: openresty

GET
H2 200 e-planning Show response
sync.quantumdex.io/usersync/ Frame 5585 3 KB
1 KB 73ms
37ms Document
text/html 2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/usersync/e-planning
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d9c10e0839eb0af810ea8a119641513b9ccf7f783c8d33e40b57bf32cccf3aa

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 727b813b0a3dca47-YUL
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare

GET
H/1.1 200
OK csync Show response
sync.adtelligent.com/ Frame 43B1 0
387 B 20ms
18ms Document
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=307971&extuid=APHjDxDa7evIVhJZ
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:40 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DAF0
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=70b3e8d7-cc97-480b-80ee-dad476c341d7&expiration=1659903461&gdpr=0&gdpr_consent=

43 B
903 B

59ms
59ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=70b3e8d7-cc97-480b-80ee-dad476c341d7&expiration=1659903461&gdpr=0&gdpr_consent=
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b813b7afca23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KJnaXB1zbP7nYV1lSoE7wNJMbgDRcOcR06dMOO9eEnH%2FKGabk0mmSXZTFVqwf8Dnw5hKSjx6fUmT21zJ58930cCTKzSlPki3xFCJmKm9HHaM22yysGDU6XjoyEcZ6s6eMjuIzsGH3CJddg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=70b3e8d7-cc97-480b-80ee-dad476c341d7&expiration=1659903461&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame DAF0 43 B
932 B 78ms
28ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: PQSXYBJW51HWNJR9QV45
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

usermatchredir
ssum-sec.casalemedia.com/ Frame DAF0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_cver=1

43 B
953 B

177ms
52ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_cver=1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H2
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b813c99b25485-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hUBZRsBoDMLzbn8F6pcQOHFpl%2FvRLp0c%2Bj2uHw4nztHEM%2Fs4Qwwoig7j24fI%2FlbIV6u58zy%2FLxpObBvsRPn4LHlaRYxgPAROXFaOdzajoOJoCiP0LLOQIeieBtuhjTx4kku58MdprW5fNg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame DAF0 43 B
992 B 31ms
27ms Image
image/gif 2600:1f18:4e9:5a02:357b:502f:f800:1eb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:357b:502f:f800:1eb Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame DAF0
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=0481e10a-fefb-11ec-99ad-d15aeeec5f47

43 B
907 B

57ms
56ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=0481e10a-fefb-11ec-99ad-d15aeeec5f47
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b813bab28a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gcYgA%2BV9bj5FzLwKwGdLp2cicdbbBd%2BkVteTl7OqLIdd2JUnSsSc7kUb9k5LvoT9iTEjPnAmOYRRzKDaspuT%2Fn6qAfBLFl4yFiV2KDwxEstrl0X0KGCosz7nnsZXGcYxAtQL1e0%2F14j%2BMA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
server: Cowboy
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=0481e10a-fefb-11ec-99ad-d15aeeec5f47
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
X-RealServer-NX: lga-delivery-6
Content-Length: 0
Expires: Thu, 23 Sep 2004 17:42:04 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DAF0
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=68
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Tv-VE_VoS8FrWeCyM7c6GpU4mbM

43 B
906 B

48ms
48ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Tv-VE_VoS8FrWeCyM7c6GpU4mbM
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b813bab2ea23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iAR%2FPIbMF9fjMyLASxjyjt8Qu8EUyYOalrf5rspk6D1P8UL9f59PYZ6Rq08eONplWBBWsbGjZTb4XIKIu04vxJr5oakHHTl0VM6s6ySAfrDU%2F4umZC5t98gqaZ0EDYMulh5gKBCX%2Fjb2oQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=Tv-VE_VoS8FrWeCyM7c6GpU4mbM
Date: Fri, 08 Jul 2022 20:17:41 GMT
Connection: keep-alive
Content-Length: 122
Content-Type: text/html; charset=utf-8

GET
H2

200

rum
dsum.casalemedia.com/ Frame DAF0
Redirect Chain

https://x.bidswitch.net/sync?ssp=index
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=index&bsw_custom_parameter=254dd7d3-92b7-4826-982b-da30ccf966f8
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=index&bsw_custom_parameter=254dd7d3-92b7-4826-982b-da30ccf966f8
https://x.bidswitch.net/sync?dsp_id=4&user_id=b4c4e194-2f45-4f77-a284-3282f71b50d9&ssp=index&expires=30&user_group=5&bsw_param=254dd7d3-92b7-4826-982b-da30ccf966f8
https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=254dd7d3-92b7-4826-982b-da30ccf966f8

43 B
942 B

123ms
63ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=254dd7d3-92b7-4826-982b-da30ccf966f8
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H2
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81403f8ba1e6-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PwCMnTLFDepH4ah6%2BK3Z9TYsOh9ndzFjmRSR%2FZ9AwpN070FqSgx81UnVR7cHNehOk4uh7PKWFYiK0LqyLJuKHzBgfVl2HDmdk9kIhdBHqumanEIjCI57hNyVWJgjhG7AFDM74e%2Bk"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: //dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=254dd7d3-92b7-4826-982b-da30ccf966f8
Date: Fri, 08 Jul 2022 20:17:42 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 ix
ad4m.at/ad/sim/ Frame DAF0 0
0 65ms
25ms Image
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad4m.at/ad/sim/ix
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 um
u-iad04.e-planning.net/ Frame DAF0 42 B
103 B 24ms
22ms Image
image/gif 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=99e41df815fd80b4&fi=43c40cadbd39e3cd&uid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
server: openresty
content-type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
0 47ms
47ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_whirs&c=sf&s=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 602A 6 KB
3 KB 20ms
18ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame BF8C 31 KB
10 KB 22ms
22ms Script
text/html 23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4a411ecc4f2769a81a8f2fc5a796ae019bbaa0ca05aa70ef91d7029e6a3f54b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=50004
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9455
Expires: Sat, 09 Jul 2022 10:11:05 GMT

GET
H2 200 drop_cookie_sw.php Show response
csync.smilewanted.com/ Frame 9FC9 0
318 B 154ms
151ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/drop_cookie_sw.php
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b813b1ac0e6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3047 6 KB
3 KB 19ms
19ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

tTWIkAlvY1oGbv0lqHgF Show response
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 5BFE
Redirect Chain

https://creativecdn.com/cm-notify?pi=smilewanted
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/tTWIkAlvY1oGbv0lqHgF?pi=smilewanted

0
386 B

126ms
126ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/tTWIkAlvY1oGbv0lqHgF?pi=smilewanted
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b813c3bdee6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 08 Jul 2022 20:17:41 GMT Fri, 08 Jul 2022 20:17:41 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/tTWIkAlvY1oGbv0lqHgF?pi=smilewanted
pragma: no-cache

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8CF1 6 KB
3 KB 21ms
20ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 4C30 0
9 B 20ms
19ms Image
text/plain 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?sGL9Ng
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1

200
OK

setuid Show response
ib.adnxs.com/prebid/ Frame DCBC
Redirect Chain

https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%...
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=56edaa99cf6bcb030a1a9703a2792592

43 B
1 KB

69ms
69ms

Document
image/gif

68.67.160.134
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=56edaa99cf6bcb030a1a9703a2792592

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.134 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

AN-X-Request-Uuid: 46a74dbc-47a3-40ca-869c-9d0d827e629d
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:41 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b813bfbaae6e0-EWR
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=56edaa99cf6bcb030a1a9703a2792592
server: cloudflare

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 69AF 0
0 65ms
61ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CawCo5ZDIYpCNA5GOjvQP2bSs4Azskq2RYPfa0tOsDMCNtwEQASAAYMmG_4fwo-wSggEXY2EtcHViLTg2NzY1NjA1OTgyOTY2ODKgAZX1m98DyAEJ4AIAqAMBqgSDAk_Qp4ozpTn7Bb1OU0HyFu_ArCxPmLrYcePVSj5R5CYInaA78vTQfOS_UcHXy-89EqC4uINnqgcy0ELopHpmzZH-lKsVyfMe6uQIL7Kkr9PM4yxASK-JG4ekwyOO5toHQR90cpFIQoTqcnmsKH20wdWo8LaIGxlJ5YwPFqT2UiNdyh6Pn2v3sxhXejePUZ7bco3GAB2On1XsQW-e4BNdj51Sb_ONmWWhJ2gif_bt_inrfpFAZK1hP0jNnWZm-Q3gG4iBqQkt4a5U8Y8i9GWGDnAsf8plh-RpVnAjtUkaz5XEBPUb-EIxmUSnADgPM4OPQuS8bIfYgnCAUQddlvjAqOYeDrTgBAGABtzng9ilwZ-x-gGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi04Njc2NTYwNTk4Mjk2NjgyGILfIg&sigh=78eMqp5vDBY&uach_m=[UACH]&cid=CAQSPACNIrLMr7pxYzWRCuG7PGH6CgcmsXYsUEjWCabsRzmiq_bLcj1mtOuUEezQIDe8UeCOrNw7yb7M76QE3BgB
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 log
hblg.media.net/ Frame 69AF 35 B
0 190ms
21ms Fetch
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hblg.media.net/log?logid=kfk&evtid=l1log&app=0&cc=US&ctr=0.0032724298&viewability=82&device_id=4&cbdp=0.889&slotVisibility=1&dn=xmod.in&acid=ac81f1a732804817a3e6b39a3524d188&ugd=4&size=300x250&pvid=294&csip=rtb-appnexus-7cfb9985db-4xzfz.SC&ogbdp=1.17&sc_pvid=319&prvReqId=36094499480383_1507523277_11621109112941&itype=ADX&requrl=https%3A%2F%2Fxmod.in%2Fblog&scrid=8032948058298&mang=1&bidrestime=1657311461193&cid=8CUU9JF8H&rme=nurl
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame 69AF 35 B
0 85ms
20ms Fetch
image/gif 23.219.92.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&ckfl=0&lper=&app_type=adx&bdr_typ=1&ss_d1=0&ogerpm=1.1700&ss_d2=0&stid=&other_prv=319%7C294&jar_err=&current_day=5.0&adtyp=0&req_id=YsiQ5QAB4fcKh4xB0ApcqA&bd_m3=0.0000&bidfp=0.0100&bd_m2=0.0000&pvag_id=&bd_m1=0.0000&ugd=4&dim10=false&predicted_wr=79.4866&exp=&second_bidder=319&search_res=24&floor_bucket=0.00&gpid_format=&seat=BID_API&size=300x250&url_l1=blog&f_seg=segment_broad_technology_computing&prdp=0.8892&ogcbdp=1.1700&dfpbd=0.8892&server=1&ogerpm_wd_bkt=1-2&model_version=202207081116_generic_adx_1-cid_0&viewability=0.8200&dmm_r=0.0000&cut=24&dmm_l=0.0000&as_cache=0&tcyerpm=&sc=IL&send_erpm=true&dmm_m9=0.0000&sd=1&hb_exp=&seg=arc_health_8%2CComputing%2Ccpa_auto_ins_pop_cat%2Ccpa_auto_ins_pop_cat_mixed%2Ccpa_wheels_ap%2CInternet%2Csegment_broad_technology_computing%2CSocial_Networking%2CTechnology_and_Computing&dmm_m4=1.0000&erpm_bucket=1.20&ugd_ver=&requrl=xmod.in%2Fblog%2F&bidrestime=1657311461193&cc=US&strg=harmony&ss=&current_hour=19&time_stamp=2022-07-08+20%3A17%3A41&model_key=generic_adx_1-cid_0&rvshhon=&mul_ratio=0.0000&bdp=1.1700&ct=Chicago&akey=&mnckfl=0&bdp_bucket=1.20&algo=&dc=east_sc&splid=&dim4=ogerpm_multiplier_used&dn=xmod.in&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F103.0.5060.53+Safari%2F537.36&buyer_id=&dmm_m10=1628910&bdp_wider_bucket=2&acid=ac81f1a732804817a3e6b39a3524d188&infl=&o_ver=NT+10.0&br_ver=103.0.5060.53&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m5=0.0000&ver=8.12.0&totalTimeBucket=4&visibility=1&totalTime=4623100&dmm_m1=2022-07-08+20%3A17%3A41.194956849&e_rpm=0.0000&dmm_m22=1.1700&gdpr=&vsid=&log_less=false&gpid_sent=false&ogerpm_used=false&bdmm_m12=0.0000&cid=8CUU9JF8H&bcrid=8032948058298&rawbid=1.1700&seat_id=BID_API&sub_bidder=186&pst=EMS&pbshr=100.0000&dmm_d10=&o_id=101&clisp=rtb-appnexus-7cfb9985db-4xzfz.SC&dfp_bucket=0.5&adblk=2987326668&itype=adx&pvid_seat=294_BID_API&cliIP=2503514368&advurl=search.yahoo.com%2F&level_base=0&crid=116211091&sat=1&br_id=265&cut_bkt=25&gpid=&iwb=1&second_bid=0.030000&sc_pvid=294&capd=0&other_bids=0.03%7C1.17
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.219.92.153 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-219-92-153.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame 69AF 159 KB
55 KB 44ms
37ms Script
text/javascript 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

f955977363ba14f95b3680db1dac0ee9f947cb59c548dcdfb68add715e900e29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-mnt-h: 21-6005
content-encoding: gzip
etag: "5b6386cd34f16b09783f941fc0e33c38"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Fri, 08 Jul 2022 20:17:41 GMT
x-cache-hits: 0
strict-transport-security: max-age=31536000
x-mnt-w: 8-8
expires: Fri, 08 Jul 2022 20:22:41 GMT

GET
H2 200 adperformance.js Show response
warp.media.net/rtb/resource/ Frame 69AF 61 KB
62 KB 212ms
45ms Script
application/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resource/adperformance.js?v=35e90bcdc8

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

51-158-29-13.rev.poneytelecom.eu

Software

nginx /

Resource Hash

3378135f525fc551ce49d2c117e9967735794757a4c71910d8c1b8fa38bf3f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=604800
server: nginx
date: Fri, 08 Jul 2022 20:17:41 GMT
content-type: application/javascript;charset=ISO-8859-1
cache-control: max-age=53698
access-control-allow-credentials: true
content-length: 62892
expires: Sat, 09 Jul 2022 11:12:39 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 69AF 3 KB
1 KB 23ms
19ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 762
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 69AF 137 KB
42 KB 69ms
64ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 69AF 17 KB
7 KB 24ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 69AF 0
0 45ms
41ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRhrgT_nBdGaBVIn1ANG-IXRvmxjCp8UK33Py87lHh2O4XtbbLh7cqbhKdBvzvz-tz0-k5BrkK0YTq5tXAmnsKOhGHloQ
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 69AF 22 KB
7 KB 24ms
21ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 06:34:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222171
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 06 Jul 2023 06:34:50 GMT

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9BBA 6 KB
3 KB 19ms
18ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 AGSKWxW1US8uy1plwmyeU0tTyzcfyoBU76Xa_VVc79gz2UxLpnmQ1jLPtCNHkbZu6rW6ga-Iy-wVxsqXx_Qlwdi73lSWlJDPOiPN-hCBoG9qrIp6aE6NR8TGWnDXFgQG8IUqGSltaBC24qc_ihZCiejxDLPYVDilGQcfQp9sdhLy5p-zueDifYqUBfzN5nhi Show response
fundingchoicesmessages.google.com/f/ 51 KB
19 KB 62ms
62ms Script
application/javascript 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW1US8uy1plwmyeU0tTyzcfyoBU76Xa_VVc79gz2UxLpnmQ1jLPtCNHkbZu6rW6ga-Iy-wVxsqXx_Qlwdi73lSWlJDPOiPN-hCBoG9qrIp6aE6NR8TGWnDXFgQG8IUqGSltaBC24qc_ihZCiejxDLPYVDilGQcfQp9sdhLy5p-zueDifYqUBfzN5nhi?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjU3MzExNDYxLDgwMDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8veG1vZC5pbi9ibG9nLyIsbnVsbCxbXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabCcpaWebSignalJs.en_US.FuqjFFq7PlE.es5.O/d=1/rs=AJlcJMwBiior-4NCV5LpZR1Lmx8wS7oyBg/m=iabccpawebsignalscript

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0992a513b3d8bbc37dc857276baa635e47704cae81e9b4c1908e8e402d3350eb

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-LJHVIqeUcwrB410Ozdj9rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-LJHVIqeUcwrB410Ozdj9rw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-LJHVIqeUcwrB410Ozdj9rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-LJHVIqeUcwrB410Ozdj9rw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK GS.d Show response
js.cookieless-data.com/ Frame 4512 0
535 B 698ms
227ms Script
text/plain 51.158.29.13
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://js.cookieless-data.com/GS.d?pa=24492&cmp=0&si=1&u=https%3A%2F%2Fs.e-planning.net%2Fesb%2F4%2F0%2F1992d%2Fbb6e7a161f794f56%2Fsirdata_03022021.html&r=https%3A%2F%2Fads.us.e-planning.net%2F&s=&rand=1657311461804

Requested by

Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.158.29.13 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

Software

nginx/1.20.2 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains; preload
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: nginx/1.20.2
Strict-Transport-Security: max-age=15724800; includeSubDomains; preload
P3p: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 0
X-Xss-Protection: 0
Expires: Tue, 01 Jan 2000 00:00:00 GMT

GET
H2 200 connectmyusers.php Show response
cdn.connectad.io/ Frame E4C3 1 KB
910 B 173ms
140ms Document
text/html 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 727b813c88e1713e-YUL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5585
Redirect Chain

https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dinmobi%26uid%3D%7BID5UID%7D
https://sync.quantumdex.io/setuid?bidder=inmobi&uid=ID5-ZHMOXLmi6UdBjBFGgycEGLlWIKUuN-twQzpwiakINA

43 B
129 B

31ms
30ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=inmobi&uid=ID5-ZHMOXLmi6UdBjBFGgycEGLlWIKUuN-twQzpwiakINA
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b813dacdcca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=inmobi&uid=ID5-ZHMOXLmi6UdBjBFGgycEGLlWIKUuN-twQzpwiakINA
date: Fri, 08 Jul 2022 20:17:40 GMT
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5585
Redirect Chain

https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsharethrough%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=d5022dde-e9f2-40cb-b5e5-48abf42312ee

43 B
95 B

33ms
33ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=d5022dde-e9f2-40cb-b5e5-48abf42312ee
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b813e1d46ca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=d5022dde-e9f2-40cb-b5e5-48abf42312ee
date: Fri, 08 Jul 2022 20:17:41 GMT
content-length: 0

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5585
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=2840070346914927031

43 B
95 B

39ms
39ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=2840070346914927031
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b813e1d45ca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 543aebf6-31b0-443c-9fe6-d2423373b344
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5585
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D&crf=1
https://sync.quantumdex.io/setuid?bidder=between&uid=ab239354-7a40-53bd-ae87-dc6bcc4f4c8d

43 B
95 B

92ms
91ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=between&uid=ab239354-7a40-53bd-ae87-dc6bcc4f4c8d
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b81401fe9ca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=between&uid=ab239354-7a40-53bd-ae87-dc6bcc4f4c8d
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5585
Redirect Chain

https://ups.analytics.yahoo.com/ups/58424/occ
https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A

43 B
95 B

34ms
32ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b813e2d61ca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A
date: Fri, 08 Jul 2022 20:17:41 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5585
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=p&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsmaato%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=smaato&uid=85a1a579

43 B
95 B

34ms
34ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=smaato&uid=85a1a579
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b813e3d73ca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-P1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.quantumdex.io/setuid?bidder=smaato&uid=85a1a579
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: Th1CglglO3AYzEIcegj1lqmJn9fR67DVaqYLUNGVMUhvB3xA-QnaMQ==

GET
H2

200

setuid
sync.quantumdex.io/ Frame 5585
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dmedianet%26uid%3D%3C...
https://sync.quantumdex.io/setuid?bidder=medianet&uid=3003130611454751000V10

43 B
95 B

33ms
32ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=medianet&uid=3003130611454751000V10
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b813ede42ca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Fri, 08 Jul 2022 20:17:42 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
location: https://sync.quantumdex.io/setuid?bidder=medianet&uid=3003130611454751000V10
cache-control: max-age=0, no-cache, no-store
content-type: text/html
content-length: 154
x-mnet-hl2: E
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H2 200 um
sync.e-planning.net/ Frame 5585 42 B
103 B 256ms
250ms Image
image/gif 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?dc=bcf310d1654d268f&iss=1&uid=d710d8f2-8e5e-421e-ad80-037876891ad3
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B6C6 668 B
325 B 78ms
37ms Document
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNX3Ap5O2jdTyeP-ratLxnxWxpxcW6eUjX1Z5zxEmtFna6qu9igoMx2j2gmzLhy-roOWmcA1r2LMzufvLPImQNlavgHRX5Yw4hxlWFPqjJCdSXbNIik

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 304
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 176838570921095027
s0.2mdn.net/simgad/ Frame 602A 63 KB
63 KB 63ms
21ms Image
image/png 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/176838570921095027

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c99bee74aefc77081cf112204158705bbaf711b1cd30d5942ba97ba77da8182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 04:31:51 GMT
x-content-type-options: nosniff
age: 575150
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64740
x-xss-protection: 0
last-modified: Thu, 02 Jun 2022 19:10:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jul 2023 04:31:51 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/ Frame 602A 21 KB
8 KB 20ms
19ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/abg_lite_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 19:16:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 19:16:38 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/ Frame 602A 6 KB
3 KB 20ms
19ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b175e3d672f1560352dc7df0b4e1aaf4cf6dba4605563465df69fcceb052bbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 12:32:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2628
x-xss-protection: 0
server: cafe
etag: 1103433747108554897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 12:32:44 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 602A 0
64 B 126ms
45ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst-pUbAGGTTb4rkai1JuOqLz-RK_3K7HLDF70-o3xPFe4bZMzU_sco7YShaHnvYXcEiu4h1uckOhYnnDeWlRusgaJXnqwOul3IKbkeK48hsUlbL0rtz33lXwwpKNO_MHLlGx02i9MMcBAT783OEvP00Da9cEq5e3tVsU8XNoHs1AnIZcBJ1EKdvXsogIOdogtwlzjWiOPmKeqdj7mYIvtSQwf3hfOGcObHEYP5O4AdYxu4KOCQVPG55t_Gqx2A6djLaz8y9SQeuEc3bUJTqQYOs6wG-_VRystGhcyTTGT0k8btwn0GbBk_0issuz38mHGJPevoIA3RSK9MQo2BdXJyzz9gJxTMW4oWGuVxCaF0PmIuVl8J4CzAouG6se7JK_SaLAjW5jle_vOJ4tTdtH8C6ZmOgeHkvvB52cm8dVIjxwesGp3HGXFIrPgYJ3-XYo3-4B3Lyxaeb9Uj-Sm8qm68HKK5N1-BsXjtrPRJt3k-8heCFqe40TvPAHZjITXrSnG6dsTKHaX8Mdtf2dx5NCZ_e-J_HG9DlNsr_eT9KX68lqS2kT6s0bwXte05COuZ79QieJcSy3WthcX5EsF5d1IqWCqMvuKXZ1HVKZ5_jEUC1VtBOm9m6SMN1yv3oLi_3NN1WFGaE_u_EjpI2n9Dh27P1JXW_nC2q5iVyS8iT8gYEMZCkpuasIhQUZ-V7v-ndLLSmKGbXiZuhIkZ127q1gaHOOmLb35ROkj0DrLT-klF_ReQOIcN_S3HxMU5WSI1iGRCZiSbs1vGMsQVrDTUO6OD1qqV-i9ymOCGP1nl7FHikwbC8_b7zkBgSzQyyLL3y8mVGIR5kmyzPj2v7jsowdMTzA8eYhgqcWv0J3H6JJ4ma4drdXfv0k2nT5cEbTurohFTJ8S8k6jEuK0or7WEQJ4itnXsx0Uuo5HCmcjy4aQ4Y_ZPrrMd8weCyOykiw-kNCOdMEbybKxDtxuKFECLJjNibhbmxJvVoiN1kYKeMEPTazjvKrpQkyH0K-7u4WOgSeIghsjebHdylfwLH1fA0SXPv0tOpQeUMsiSEZ64IPXnQnd619bvJbbRevDS1RJ6op9Z-qmXs1blESVTQKuCeYT1R1rKUXS-1HLea38ZGwKZ7_9h_BuX3w6PurXSHn1TLqQegsI5iwijDETqJG2_9d9eQYPggl9rpnv8KvczUrn7h50vD&sai=AMfl-YSzR1zxplQxXz_C-zdTs0C9uA8BX3IFbTncMEiYXuFiXaKWIUIrLGj0VjcgXkvFgOc4mh79_F_WMX7LtzYr9-S_nIvd_5Us1kOlX5NlWa4PxwAlnohdE1ck8EpZCfOeC0c7uQavIzztkZLk7QGd_J6FYPJBE5SzIOKiHAt3Irqq_G94BlQzjYwZuMYr7rQZdKMb0Z-rZXNCYAV8KpUfBM12uZZkrnDwdy-uM93B7h1s4TnAeQARwXP-TZCtGD6OYrvFqQXCLTndi07jUg8vW-9n2orAxOCeOc2WWnyX0b28&sig=Cg0ArKJSzGHh2NZX214AEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220706.87269&adurl=

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 08 Jul 2022 20:17:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 602A 41 KB
15 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 18:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92759
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Jul 2023 18:31:42 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 602A 42 B
63 B 47ms
47ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ApuvHLHA-xKxl67NkZmHXPxj-lrHRknrjXnNI8PILjb0B3IiXSLbqsmbFOAeUNZk2VW7dupADglFFdp4kscq348e2KFLaiByLIoSWykGzpf3lwD_4

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 602A 3 KB
1 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 762
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 602A 137 KB
42 KB 111ms
109ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 602A 17 KB
7 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 602A 0
0 38ms
37ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ0TcNWUp47RLlZeu54x42KlXXUE7XCAKxWn_JF4Pkb7ymrWjTYIhq_YAhB-ojxpb8PDIwh9aj9jYVMWWmjlMYUI0n-4w
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET getuid
sync.smartadserver.com/ Frame 1F07 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 7F27 15 KB
6 KB 21ms
19ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156813&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID

Requested by

Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52838
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 981C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17184-d
https://eus.rubiconproject.com/usync.html?p=17184-d

281 B
554 B

19ms
18ms

Document
text/html

23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:41 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 08 Jul 2022 20:17:41 GMT
location: https://eus.rubiconproject.com/usync.html?p=17184-d
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 7FDF 2 KB
814 B 12ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=75a1922f904cc20

Requested by

Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK csync
sync.adtelligent.com/ Frame 258F 43 B
323 B 18ms
17ms Image
image/gif 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?redir=
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 43
Content-Type: image/gif

GET
H2

200

/ Show response
de.tynt.com/deb/ Frame ACF4
Redirect Chain

https://ic.tynt.com/r/d?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X

1 KB
2 KB

42ms
34ms

Document
text/html

67.202.105.32
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.32 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip32.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: ae192b7216628a27b947b28b6716df477a7c565ca3188501db60da14458e18f3

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1328
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
content-length: 171
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 20:17:41 GMT
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
location: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
server: nginx/1.16.1

GET
H/1.1

200
OK

csync Show response
sync.adtelligent.com/ Frame 5490
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D319130%26extuid%3D%7Bdevice_id%7D
https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=c200cde8-8ecd-4daa-bb36-66df8263fbd7

0
407 B

18ms
18ms

Document
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=c200cde8-8ecd-4daa-bb36-66df8263fbd7
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:41 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 727b813cdfbd7144-YUL
content-length: 0
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=c200cde8-8ecd-4daa-bb36-66df8263fbd7
server: cloudflare

GET
H/1.1

200
OK

csync Show response
sync.adtelligent.com/ Frame 9097
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D584890%26extuid%3D%24UID
https://sync.adtelligent.com/csync?t=a&ep=584890&extuid=2840070346914927031

0
390 B

32ms
18ms

Document
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=584890&extuid=2840070346914927031
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:41 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

Redirect headers

AN-X-Request-Uuid: fd35bf5e-e0f9-47a0-97d9-5a106834f56d
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Fri, 08 Jul 2022 20:17:41 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://sync.adtelligent.com/csync?t=a&ep=584890&extuid=2840070346914927031
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 627D 2 KB
814 B 11ms
11ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=59a18369e249bfb

Requested by

Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync.html Show response
s.adtelligent.com/ Frame 4D71 1 KB
1 KB 260ms
260ms Document
text/html 2a06:8640:506:0:ec4:7aff:fec2:7e6e
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adtelligent.com/sync.html?aid=651796
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:8640:506:0:ec4:7aff:fec2:7e6e Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 9c79af78cb324a3ca6c879d38313c4eb4025972decd05170d88f4b486f43acef

Request headers

Referer: https://s.adtelligent.com/sync.html?aid=656378
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://s.adtelligent.com
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 783
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H2 200 / Show response
ads.us.e-planning.net/uspd/1/ Frame A58E 2 KB
1 KB 37ms
30ms Document
text/html 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 803d7aa8a40bdcf15505d1810c9b386191adec3897b1d009f31012403a70bf79

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
expires: Fri, 08 Jul 2022 20:17:41 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1219

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 397B 15 KB
6 KB 25ms
20ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr={gdpr]&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D558003%26extuid%3D

Requested by

Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52838
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:41 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame 6CC3 1 KB
1004 B 26ms
22ms Document
text/html 23.227.146.66
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.146.66 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 8a77716d191bdcbb71ccafbe17e67b9e6f45d58e3c7477e3c9b7d7b9321c6f5a

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://s.adtelligent.com
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 699
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6BE3
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309255%26extuid%3D%24%7BUID%7D
https://sync.adtelligent.com/csync?t=a&ep=309255&extuid=837a3169-7e60-066c-2a47-31c1bb4ec1bd

0
407 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=309255&extuid=837a3169-7e60-066c-2a47-31c1bb4ec1bd
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:40 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://sync.adtelligent.com/csync?t=a&ep=309255&extuid=837a3169-7e60-066c-2a47-31c1bb4ec1bd
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: c7qimovbb8dmr6jvh12809p8vccmkfsi

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6BE3
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=adtelligent
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=110&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fcentro%2F2069.44%2F%7BuserId%7D%3Fzcc%3D0%26sspret%3D1&rndcb=3489391854
https://sync.1rx.io/usersync3/centro/2069.44/a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341?zcc=0&sspret=1&rndcb=3489391854
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D541630%26extuid%3DRX-3e523e7d-41a1-44ba-ae91...
https://sync.adtelligent.com/csync?t=a&ep=541630&extuid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005

0
414 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=541630&extuid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: Tengine
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://sync.adtelligent.com/csync?t=a&ep=541630&extuid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Connection: keep-alive
Content-Type: text/html

GET
H2 200 sync
vid.vidoomy.com/ Frame 6BE3 0
0 270ms
91ms Image
text/html 2a02:6ea0:c400::19
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vid.vidoomy.com/sync?gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D556847%26extuid%3D%7B%7BVID%7D%7D
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c400::19 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6BE3
Redirect Chain

https://ad.360yield.com/server_match?gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D289656%26extuid%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D289656%26extuid%3D%7BPUB_USER_ID%7D
https://sync.adtelligent.com/csync?t=a&ep=289656&extuid=65e67f5a-e827-4f35-bc7c-ff637962f11f

0
407 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=289656&extuid=65e67f5a-e827-4f35-bc7c-ff637962f11f
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

location: https://sync.adtelligent.com/csync?t=a&ep=289656&extuid=65e67f5a-e827-4f35-bc7c-ff637962f11f
date: Fri, 08 Jul 2022 20:17:42 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6BE3
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D297253%26extuid%3D%24UID
https://sync.adtelligent.com/csync?t=a&ep=297253&extuid=2840070346914927031

0
390 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=297253&extuid=2840070346914927031
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:41 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: fc5c41a4-ffce-4c4e-9497-be0a3db9c4de
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.adtelligent.com/csync?t=a&ep=297253&extuid=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6BE3
Redirect Chain

https://a4p.adpartner.pro/ssp/match?redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307558%26extuid%3D%7Buser_id%7D
https://sync.adtelligent.com/csync?t=a&ep=307558&extuid=49afbf36-2eed-4757-ac00-3550fb683955

0
407 B

19ms
19ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=307558&extuid=49afbf36-2eed-4757-ac00-3550fb683955
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

location: https://sync.adtelligent.com/csync?t=a&ep=307558&extuid=49afbf36-2eed-4757-ac00-3550fb683955
date: Fri, 08 Jul 2022 20:17:42 GMT
cache-control: no-store no-transform
server: nginx
content-length: 166
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6BE3
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D310570%26extuid%3D%24UID
https://sync.adtelligent.com/csync?t=a&ep=310570&extuid=E8WhbNZHCQrNXmybSwypSL-y

0
395 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=310570&extuid=E8WhbNZHCQrNXmybSwypSL-y
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://sync.adtelligent.com/csync?t=a&ep=310570&extuid=E8WhbNZHCQrNXmybSwypSL-y
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2

200

pl
lwgadm.com/usermatch/ Frame 6BE3
Redirect Chain

https://sync.adtelligent.com/csync?redir=https%3A%2F%2Flwgadm.com%2Fusermatch%2Fpl%3Fbid%3De224d663-d5a0-49ff-baf5-6a5e88c72e07%26buid%3D%7Buid%7D
https://lwgadm.com/usermatch/pl?bid=e224d663-d5a0-49ff-baf5-6a5e88c72e07&buid=1b86d3e9a2be5dbf

70 B
572 B

101ms
101ms

Image
image/gif

18.185.189.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lwgadm.com/usermatch/pl?bid=e224d663-d5a0-49ff-baf5-6a5e88c72e07&buid=1b86d3e9a2be5dbf
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: H2
Server: 18.185.189.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-189-177.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cache-control: no-cache,no-store,max-age=0,must-revalidate,private
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 70
content-type: image/gif

Redirect headers

Location: https://lwgadm.com/usermatch/pl?bid=e224d663-d5a0-49ff-baf5-6a5e88c72e07&buid=1b86d3e9a2be5dbf
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

GET
H2

200

65e67f5a-e827-4f35-bc7c-ff637962f11f&partner_id=1010 Show response
csync.smilewanted.com/set_partner_userid_get/improve/ Frame 6645
Redirect Chain

https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010
https://ice.360yield.com/ul_cb/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/%7BPUB_USER_ID%7D&partner_id=1010
https://csync.smilewanted.com/set_partner_userid_get/improve/65e67f5a-e827-4f35-bc7c-ff637962f11f&partner_id=1010

0
469 B

136ms
136ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/improve/65e67f5a-e827-4f35-bc7c-ff637962f11f&partner_id=1010
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b813ded32e6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

Redirect headers

access-control-allow-origin: *
content-length: 0
content-type: text/plain
date: Fri, 08 Jul 2022 20:17:42 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/improve/65e67f5a-e827-4f35-bc7c-ff637962f11f&partner_id=1010
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6150 503 B
281 B 38ms
37ms Document
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjYrIHMATAB&v=APEucNXBVL374Hk3Lh_fvY2dVJUWb9X1GZpUPIZzNlXTaQVrQ7ENt6pxONSkYixFH8ZHKnMl94d9klLktRpyWGGve8NVnh8EE-PVCxZNKR-nLwCbKDSSJpE

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58644b7dfa826a3291e2e5d6c2974b47906616e1aa03a2f757fdd1bde7796621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 260
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/ Frame 3047 21 KB
8 KB 21ms
19ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/abg_lite_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 19:16:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 19:16:38 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/ Frame 3047 6 KB
3 KB 25ms
22ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b175e3d672f1560352dc7df0b4e1aaf4cf6dba4605563465df69fcceb052bbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 12:32:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2628
x-xss-protection: 0
server: cafe
etag: 1103433747108554897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 12:32:44 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3047 0
622 B 53ms
44ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstaQVUkMXiNjztw0xw0d2am1CYZrb95_aMTvlt-FVXmzRlFU4LvqSq-BVtfngxNBzYkNv-VvKnODXA8ouFrHYTUSAy_PPGliAr2vqfwfCWc1jRL3LCEgWLpbJ6TQZZzSaIY67nUZvxu3G7d7-HV0oc6uQhkBAXu-PXhhjYV8OukMjHionuDsPLI0PwAMYIIca0IFYJNDA8-sQObD_iLSplRZMaxEVrVzEY0euJ_ixi4kl_6jkeKpHtyAU2WtVDflpVGIxhw2_Y-VjV0D2FkriAU5mrINHlhNKY_tAftiuga_AbUl5HlUOQrLMGnx4QzogGrNq4VRADPu4QV2vQ2eT0n5IoK2MvJWkSX1kcX1svVLNM1WFuq_WVUPzE5qKX6zFRZLEqeGJg55yunjEW55USmLN9fyS0PYCTcW9bX8w5WhMgtfJpEs-Mq4FnCD4iW9WNh99ApJ07IYlKuoiLI7duNJ-vTtOf7nNpYc1hItSAXGjR44IOERIvvPemaXSbKTaUhkssvyK1a7i8Szz-YvUoZGeoUAXOzqd-9si28ZLcObVV2ihLgyXXuRXIzsOl2CSODgO38bfSCt1LY503wdnO02t9jkDECUp6q1NrON6TdaxzxQnPeNXew2B4_rPht8Xi-rT3yQvlZ2U8r9TfUt-tYqevX8680Noqv5S2ih5HIJ1in1P2zCz5uJ0mZjPj2QMjvgnq0AJQgPd_bX0pwH-hY2E_Iitvg6WN8X8GfUk4IvIVDeCSxdUi2MKZkaOCk8c7WnIZ2f6d_JDCTKwUY0mlww_gjlrQ8vdd156GPyJQGCCM-PaDuBnSqWx_sjbAqaVHoSOk6O4qnTE0JhuFSJPZtAL8YRTDl1qAUERagSK8zPhIvTQhQQj9MkEdrxsFLRt5ZyXUFfVCBETTlbXTT8rmPbZQ-9wYDMTG2ThXgsY3P9dq_-VLQDeiUgbH_IeFi-z1E8-t5khA_6vTh6vdsLyWrZv-TXj5vg_6Xt2oLBx6GnFM6eo3bMaa9m0wW8j_HTzbvipVDKcfNqjeVhZqqHnbEKIfuzxIKfnSZiVojvrYhUD0oSWYQ46L2wP2ZmPvf4EzT0DLgDIHcmkWfwgmhSqralEXuOpbJBSeJSv6RfX8hR6si6dl9-pKNRAlg-miBuSqJCCBLi2jox1lT6WXUzlihfPiMdg1VfdYH2PDq64HW3-9P&sai=AMfl-YS_62G-myXikvmCZsFvEOpV6tCgU5GDVxSa6-LPuKxh-ctUrsYIKh_syLIjZM5sQx9KO8IxNwUmCsujzUo8FOsHGn3VJy1VHV6iEI2Lk1S081aixNF_m0ZR_qWRbZxQVo1CjuS2Mg70RpG0qH35PEttra7hHCoDpN2POHciUzwKae7lRVOk81v4G4PsXKrq_h0ydRU0UQz1EjH4U_m7P8JuV70Fh8GJfFuf6wamoNk7crhS58InKXRxImJ5CPcVpz5xLlq0szGDtVDpSxtHvHrWwo3xbhaDvWqT5zOpPFtO&sig=Cg0ArKJSzKFWb6vlBvBiEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20220706.09725&adurl=

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 08 Jul 2022 20:17:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3047 41 KB
15 KB 29ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 18:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92759
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Jul 2023 18:31:42 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3047 42 B
63 B 54ms
46ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CbQZFgfHhsMqyyKSg3zPp7P6F_5-g6vjZlA_qqYw7SGtf287UCvqYqO5EMTjPUWb9okuoer3FPqdiNSiYHAYEHFGAQCp76a9pt7_4UyLhdtKHJH14

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 3047 3 KB
1 KB 34ms
27ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 762
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3047 137 KB
42 KB 66ms
58ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 3047 17 KB
7 KB 29ms
21ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3047 0
0 45ms
37ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTIK4V7jQJLpwm_ZdMXAfB1gxJXEbgc0dhKDl0CWiam29HOlLgv-OETuYg5QI5mxLcKRpkuzmuUx9-dyO98c7-AhI7KPg
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 12396383140516048921
s0.2mdn.net/simgad/ Frame 3047 58 KB
59 KB 30ms
22ms Image
image/png 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12396383140516048921

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d860ce7449b2905cac524489cb0fd772e266df0e7b46f2943bf3447bed6363

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 04:19:38 GMT
x-content-type-options: nosniff
age: 575883
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59870
x-xss-protection: 0
last-modified: Thu, 02 Jun 2022 19:10:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jul 2023 04:19:38 GMT

GET
H/1.1 204
No Content pbsync
usermatch.targeting.unrulymedia.com/ Frame B51A 0
0 147ms
25ms Document
text/plain 199.127.204.147
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=${GDPR}&consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&rurl=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 199.127.204.147 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: Tengine

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame F8C3 2 KB
2 KB 92ms
68ms Document
text/html 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9c0ad4df57cc469e4eb26ce229e1d2cc63537ad2391501373efd932e9f256e7

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 727b813d4f2453dd-YYZ
content-encoding: br
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
dropped-udsids: 46|88|206|130|188|190|17|47
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BCUUgu9%2BudolEW7yZsB%2BX5k9r1udP%2FVlBREVHvBJC74MQ4VfFq0%2BSxyYvMURtpxFOAaVsSSLHpefilSdSCDb2IZGsiM1cPelNpZvks3SJ%2Bkg4KXHABd2dx7G6OhAZ5ycS2wzC8YGXvHw3A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 2F49 2 KB
814 B 12ms
9ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2bb78272a859ca6

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame AE63
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7517899671563583421

0
406 B

18ms
18ms

Document
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7517899671563583421
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:41 GMT
Etag: 5af40ae811d41453
Server: VertaMedia 1.0

Redirect headers

content-length: 0
content-type: text/plain
date: Fri, 08 Jul 2022 20:17:42 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7517899671563583421
server: nginx

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame FB0D
Redirect Chain

https://sync.console.adtarget.com.tr/csync?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D318342%26extuid%3D%7Buid%7D
https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453

0
387 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Location: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 5af40ae811d41453
Content-Length: 0

GET
H2

200

L5CWGBJG-1Y-B9H5 Show response
csync.smilewanted.com/set_partner_userid_get/rubicon/ Frame 0712
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent=
https://csync.smilewanted.com/set_partner_userid_get/rubicon/L5CWGBJG-1Y-B9H5?gdpr=0

0
530 B

126ms
126ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/rubicon/L5CWGBJG-1Y-B9H5?gdpr=0
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b813dfd4ce6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
Expires: 0
Location: https://csync.smilewanted.com/set_partner_userid_get/rubicon/L5CWGBJG-1Y-B9H5?gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
content-length: 0

GET
H2 200 smtr Show response
contextual.media.net/ Frame 4A94 62 KB
26 KB 281ms
280ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T586N56&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311461246412568&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=B4zx%2F8fOnRrolnfOur8Bge4B&bdrId=294&ntv=0&matchstring=hr%3D1%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058298&kapc=16&ekals=775EJvu99ui%7C%7CENvuF%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

96a844b5af0e5d0a723e178bfe2a4005cddf6ffb6bfde6e023692e30e99439f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 26509
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
expires: Fri, 08 Jul 2022 20:17:42 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-sc-h: 21-eh1n
x-sc-w: 21-c9w3

GET
H2 200 bping.php
lg3.media.net/ Frame 69AF 35 B
189 B 133ms
19ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=531&&gdpr=0&prid=8PRN625DH&cid=8CU5RJ1PV&crid=845116586&vi=1657311461246412568&ugd=4&lf=6&cc=CA&sc=QC&vsid=3003130611454751&lper=100&wsip=2886781036&r=1657311461984&requrl=https%3A%2F%2Fxmod.in%2Fblog&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=16276&vgd_rakh=1657311461178968406&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_pgid=p1947862235t202207082017&vgd_pgids=1&vgd_uspa=0&hvsid=00001657311461982025035145472055&gdpr=0&vgd_end=1

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:42 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 5D21 15 KB
6 KB 19ms
19ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52837
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8596 356 B
240 B 37ms
36ms Document
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjYrIHMATAB&v=APEucNWi5-5iX9HLks2WbzZmpiltQrc4iMH7iAHbBA3TdSZ45j1hvX4q6tW1-pMlhfFSQ9BlwbfzV5SlfGTm4bvAvn81MKXqQpTrcKF3bdXyy6Aw0OZvO1A

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55f56026d86468db4135723445d1df3498809ce536fa7a518b2847d7e6a27a96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 219
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 12396383140516048921
s0.2mdn.net/simgad/ Frame 8CF1 58 KB
59 KB 20ms
20ms Image
image/png 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12396383140516048921

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d860ce7449b2905cac524489cb0fd772e266df0e7b46f2943bf3447bed6363

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 04:19:38 GMT
x-content-type-options: nosniff
age: 575884
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59870
x-xss-protection: 0
last-modified: Thu, 02 Jun 2022 19:10:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jul 2023 04:19:38 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/ Frame 8CF1 21 KB
8 KB 21ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/abg_lite_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 19:16:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 19:16:38 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/ Frame 8CF1 6 KB
3 KB 22ms
21ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b175e3d672f1560352dc7df0b4e1aaf4cf6dba4605563465df69fcceb052bbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 12:32:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27898
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2628
x-xss-protection: 0
server: cafe
etag: 1103433747108554897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 12:32:44 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CF1 0
27 B 84ms
44ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuQlt0knwz3detrslFhhlQPQ1a_woknX5adQJiNogu81LfLCcxYFCXjRgYEUeoDE0hVbpbl5BX_yO_KCndgfyusPkR0Sq0snT0WcCmEqZYHdR-gGGccOEycVANA5sKnp3qiGPbgMaNd26Yn90lo_xAGigGMV0eF2fRtGlcVKcE4S_7eYJE6L0uF5FVr8YgzdQjC77bxYTqCn5mptdvyqZhYjrXBwrkX7aEw1QzhMKNGHXf8fN3Hv7a7HRc48AkBafjp0BuS1wfbJme9bBKKhpMMuPRvCXrJbEzuMv_OmcrFYJH_P00fW5VbSNKdbU1vMvTet_mFcSRXIjqqViqGqshfmWimdzzmo1ffnjZ3ZxWVlJgorK5am7NVRG2fkHDuMHGfv7OvMiC0-X1It7i6rdg3bTJv0qJs7p9MdyzcPz-0c41EZtCKjD0uN1sQvFlxIHLIeJX6LiMqe73eYECYTuEWe_QxS7R4xJSsb8Qj7gs9yZXG5nht42BDs6bwP_HZEGy4c_ZrqSAoeKymephC_97OOd-3HXC-X5i17Ikv361PD5fyWkcUHaAFdds-6TAiXSh1XIDwr5AHhvG_ALLqLGfxflhrHUIjZAkmeRHNS3q-AU3PRp3prjGf_xKN1ld61RPJ5f01cp4ItVG782iU10ftvqV16KS77DDOp9glymVOKat8BbTVPi_JW21fBRBPo4YbAxaC_-OkEXUC2ZpMr8f14uVIX3x-yU2Ehfag3t4H-Ur3XplDq7FSrb49ZphC6TxeDB-6QwQeLz7_MpW-hYaVMCDutjx3zdYQ72WARAtoimJugtzm15oRG9HJwfGxInWi5FGcqQX7tRUtWdknzoylRtnhST7Y0SQYihGOHpoHiLQ9IagqpjMo62lcZ685bvjK_MoOSLb7K9dMti58sBn6iQ9tdvIjcn2yxsHsSDYk0RW4YJKnBzVmjoOp5uugT-f6oOhVQTQgYjR8sMZMRZKljq3ticcm0ndecx9YjD5-uZyUEo-2tNQ2imBbCKyltcdW3HTsUlqrR36cIe7fpShkuTNgShtS9VG3hwJg20LPIbiDOrNaEvqBV6j59sQz8HuudZtldIj_6WqV7PRZqhAE1T-BRA-IHuKHLTMo_pMl4Ucmjlxq3HhcIe-FpcS36Bfs8AmvN2VFX7rPmbJw08m5I7YvL8kHHeXQY9CXWcik&sai=AMfl-YQI_57iUOw6wmTQyetgS0bjdTPzpSGOTTtZo1kotsRCcaGwHYEROqWvfBzCvl2zcYH9setpVGBmgZt08SqqvR8RBnjUA0xGZXsvQRJNDve7CsgfCGsCkK2XsZYHZdjSaoLhj-ZWQglFtmZz-sNqOvxlofYR2fbRBOZj8j5rMbN_RpBlu5ExyvQBq61m7u-y9BVR8zqlQZcD38AdPAgbztlfarLqGiqzUvTmL8pVxXSUyCV3KJkGW9GF-IXpIAacQqdX4M1t3YpNn4LO9nflU-8GCov_j79qP6zBcsHLK4Xe&sig=Cg0ArKJSzOYcoMpcYpQ_EAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220706.08448&adurl=

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 08 Jul 2022 20:17:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8CF1 41 KB
15 KB 21ms
19ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 18:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92760
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Jul 2023 18:31:42 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CF1 42 B
65 B 50ms
49ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CC_rMxdQTxdheH1fd7Q2kwC2Evy8KcbqgqVOwuSXec0DDZKLODnQTgU9Jqm6DIf6btBz8NeCD5eSDQgWMkykq9H5IECBkwr0ZTgvNikmzND_6J0dY

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 8CF1 3 KB
1 KB 25ms
24ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 763
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8CF1 137 KB
42 KB 47ms
46ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 8CF1 17 KB
7 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8CF1 0
0 39ms
38ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSbjMHhDiii-gNIx4_rKodKcahaLuQQuO99l-8rQLBpBEZdZy65qkCEBQVXIAEDW0VDi-q6njvbuU7JlzjcIBeH2XyHew
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

POST
H/1.1 200 899.json Show response
id5-sync.com/g/v2/ 451 B
1 KB 97ms
97ms XHR
application/json 141.95.98.71
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/899.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161325/6083/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.71 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

73feeb1467f5deec701dbe2f14a0e424464b54848a50a01bc31d3cc3d367003f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
p3p: CP="CAO PSA OUR"
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8
transfer-encoding: chunked

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
247 B 86ms
40ms XHR
text/plain 34.120.155.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=1258
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161325/6083/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.155.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.155.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H2 200 id Show response
id.crwdcntrl.net/ 154 B
816 B 51ms
38ms XHR
application/json 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161325/6083/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: e96f57612960094af51178afd7b93f395143d12ef296cee3b542b606cd3f7cbc

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://xmod.in
cache-control: no-cache
x-server: 10.40.14.203
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 154
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
713 B 26ms
24ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161325/6083/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 03a0e3b9fafcafdaafd8413ce306762c7dc78cb31027af16995d9cd8e5741fc8

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://xmod.in
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Sun, 07 Aug 2022 20:17:42 GMT

GET
H2

200

YsiQ5QpkrhWTB2VNAb45aAAA%26146 Show response
csync.smilewanted.com/set_partner_userid_get/indexexchange/ Frame A42F
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=193216&cb=https://csync.smilewanted.com/set_partner_userid_get/indexexchange/
https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YsiQ5QpkrhWTB2VNAb45aAAA%26146

0
652 B

128ms
127ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YsiQ5QpkrhWTB2VNAb45aAAA%26146
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b813e9dfbe6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 727b813e380653dd-YYZ
content-length: 0
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
location: https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YsiQ5QpkrhWTB2VNAb45aAAA%26146
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DkzGvGJ4SQDdYCwpUNY%2Bp6RQA5Z%2B4KfSEeur12TT0XMIBtiztxm41IeenB3j1ICbJMqzlt5GDA%2FTEWzXB3Oua9u8fPcl2LYyJoQrjSolzZW0mdgDchfhZ6CkoLviT2UQktpRlqFzVmfOsw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 602A 0
26 B 49ms
37ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 2E8A 26 KB
9 KB 46ms
45ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C4%2C20000%2C313%2C10000%2C9%2C319%2C294&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

4a34cf7a580b600dbbba734ec62fcb28f479657a859944722e1b1e99ff42e4da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 9326
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expires: Sun, 10 Jul 2022 20:17:42 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 clog
hblg.media.net/ Frame 69AF 35 B
172 B 21ms
19ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/clog?logid=awlog&pixel_len_bucket=4868&lmt_enf=true&req_mtype%3C%3E=0&mx_nsz=1&spSource=0&ifst=0&vid=YsiQ5QAB4fcKh4xB0ApcqA&s_city=charleston&ugd=4&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D2%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1%7Ctpi%3D1&app=0&ctr=0.0032724298&mx_TAF=2&sc_bdp=0.030&device_id=4&ae=false&mx_UCC=4&prspt=headerBid&mx_bss_algos%3C%3E=0&usp_status=0&seat=BID_API&og_cbdp=1.170&size=300x250&mx_TAS=1&mx_gpid_sent=false&xtmax=290&commit_id=6ac920ad&scrid=8032948058298&itypeid=17&mx_SPRIG=2&viewability=82&renderer=1&be=0&rtime=42.0&adj0=0.0&tmax=300&s_ip=74.125.78.129&adj2=0.0&adj1=0.0&adtypes=0&mx_aabpc=0&reqid=YsiQ5QAB4fcKh4xB0ApcqA&sc=IL&sd=1&mowxReqId=ac81f1a732804817a3e6b39a3524d188_1&ifdp=0&requrl=https%3A%2F%2Fxmod.in%2Fblog&bidrestime=1657311461193&pv_adtype=0&cc=US&strg=HARMONY&cxtSgmt=segment_broad_technology_computing&pcrid=8CU5RJ1PV-845116586-28-25&coppa_enf=true&sc_prspt=headerBid&bdp=1.170&ct=Chicago&spIsReq=3&s=1&abs=0%7C0%7Cxtmax%3D290%7CHARMONY%7Cbrr%3D0&mx_epbc=8CU5RJ1PV&dnt_enf=false&mx_ssBucket=0&vls=0&asn=16276&mang=1&sc_cbdp=0.030&fleet=appnexus&mx_isLossNtf=false&advUrl=https%3A%2F%2Fsearch.yahoo.com&dn=xmod.in&pgcatiab2=628&dt=O&acid=ac81f1a732804817a3e6b39a3524d188&actltime=47&act=headerBid&iframingState=0&mx_lr_seg_deal=0&exclattr=32%7C34%7C70%7C13%7C14%7C15%7C16%7C48%7C17%7C114%7C18%7C19%7C20%7C22%7C25%7C26%7C27%7C30&dfpBd=0.889&sckfl=1&dmm_erpm=true&mx_lr=0&mview=1&smbrid=adx-unknown&bfs=103&rfc=-1&prvApiId=8CU5RJ1PV&epcexp=false&pubid=pub-ADX-116310109131&mx_bsProfile=0&cid=8CUU9JF8H&bcrid=8032948058298&omul=1.0&res_mtype=0&apPrfs%3C%3E=60%23%2315%23%2313%23%2310&suid=CAESEEDbbBwOYugU9XTgTDofEwM&chnl=HARMONY&pst=0&reqsize=300x250&adpos=1&itype=ADX&mx_g_one_uid_sent=None&spCst=0&tgtval=pub-ADX-116310109131&__expireat=1657312061449&lmt_status=N&reftype=3&viewability_vendor=EXCHANGE&prvAccId=845116586&ckfl=0&lper=1&mx_tgs=300x250&cbdp=0.889&sc_advUrl=https%3A%2F%2Fsearch.yahoo.com&pvdTmax=245&ltime=47.0&epc=845116586&ctr_vendor=EXCHANGE&prvReqId=36094499480383_1507523277_11621109112941&zip=60641&exid=31&spFst=0&mx_GCID=0&cliIPType=v4&pexid=ADX-pub-8676560598296682&ybnca_erpm=1.17&brsrclk=0&sbdrid=186&rtttime=63&apTags%3C%3E=75&mx_PC=1&wsip=mowx-lite-7776598566-t2zhg&currsrc_date=2022-07-08+00%3A00%3A00&sc_adj0=0.0&sc_adj1=0.0&sc_adj2=0.0&psrc=fail&geoll=false&debug_ts=2022-07-08+20%3A17%3A41&policy_enf=2&mx_ssProfile=0&mx_SC=0&reftime=60&pbidflr=0.010&spbf=0&currsrc=API&fpusp=false&lmt_applied=N&mnrfc=-1&pub_blk_enf=1&amptype=1&moau=true&ocurr=USD&snm=SUCCESS&mx_IAB2=1&usp_enf=1&bidflr=0.010&sc_ogbdp=0.03&incentive_type=0&skadidfl=0&pid=8PR113JGC&spTo=3&pvid=294&schain_cmpl=0&is_ortb=false&mx_aurl_hc=0&ucrid_ver=2&mx_maq_call=false&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=1&dbf=1&gdpr=0&gqid=AADH9t8J5IrN4lWhmSYhgMKX_0jvybmlxwfgfAVME9DVqr7pk5CBV3PHMM2Kgk8j-X9LB7P0&dmm_ogerpm=false&csip=rtb-appnexus-7cfb9985db-4xzfz.SC&mx_bsBucket=0&mx_aurt=0&spIvt=3&ptype=23&media=0&smsrc=1&acsn=1&dtc=east_sc&mx_aqcpl_crid=4&ogbdp=1.17&tpbTkn=false&adblk=2987326668&fpuReq=1&vcmplrt=-1.0&crid=116211091&geo_source=2&sat=1&mnet_ckfl=0&mp_seg%3C%3E=44632%23%2360149%23%2344652%23%2344661%23%2344629%23%2361058%23%237688%23%2355664%23%2352765%23%2343988%23%237708%23%2317191%23%237717%23%237685&sc_pvid=319&opbidflr=0.010&impId=1&rme=adm&bdata=sd2%3Dnull~iurl_l%3D20~ogerpm%3D1.17~vis_sd%3D199~url_rps_b%3D6.43~dom_b%3D1~dc2%3D1~scd%3Dqc~v_asn%3D16276~dom_l%3D20~vl2r_sd%3D2022070808~iurl_b%3D717.11~url_tkc%3D9~url_r2a_b%3D0~std%3D~MP%3D.*blog.*~last%3D~vis_url_b%3D0.54~ip%3D2Jqus0~fbb%3D0~vis_url_l%3D30~riipua%3D0%2C0~et%3D40~rc%3D1~risuid%3D0%2C0~rps_sd%3D2022070813~vis_b%3D664.92~url_b%3D1.39~vl2r_url_b%3D0.02~vl2r_url_vi%3D470~url_tvi%3D466~url_l%3D20~gcat%3D501022~bb%3D186~vv%3D0~cvl2r_sd%3D196~l2r_b%3D1000~erpm%3D1.17~vl2r_url_kc%3D1E1~vl2r_up_l%3D20~bm%3D1~sid%3D845116586~sd%3D1~uid%3Dh8grWFqNSbjK2eN2W~url_rps_kc%3D1~cvl2r_b%3D3.12~btd%3D942853204152420213051999141983095605464314674171754972962471712361339088801792~cvl2%3D19.72~3pcf%3D1000.31~uim%3D0~dmm_strg%3Dharmony~vl2r_up_b%3D0.02~ss%3DNA~uiw%3D-1~ce%3D0~rps_b%3D135.87~url_srps_b%3D18.34~CI%3D2702~nts%3D1~MP2%3D.*blog.*~tb%3D-1~ct%3Dmontreal~basis2%3D196~basis1%3D196~isRef%3D0~PF%3D0~isif%3D0~lc%3D1~url_rpc_b%3D0~bid%3D1.17~dc%3D8~url_rps_rv%3D0~vl2r_b%3D12.92~supply_tag_id%3D%7Eviewability%3D0.82%7Eamp%3D1%7Ecbdp%3D1.170%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3D%7Ehtml%3D1%7Eadblk%3D2987326668%7Esobp%3D0.03%7Ectr%3D0.0032724298%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D1.170%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D2987326668%7Edetected_tag_id%3D%7Edcut%3D25%7Edogb%3D1-2~ibc%3D1~ddt%3D-1~nsz%3D1~tgs%3D300x250~bsb%3D0~bsp%3D0~tmx%3D245&utime=916&sf=0&cpr=0.03816370043901007
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: max-age=3600
date: Fri, 08 Jul 2022 20:17:42 GMT
server: Apache
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=21600
content-length: 35
expires: Sat, 09 Jul 2022 02:17:42 GMT

GET
H2

200

056dad1e-fefb-11ec-bb3f-1df272450503 Show response
csync.smilewanted.com/set_partner_userid_get/spotx/ Frame 7DDE
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=178357&redir=https://csync.smilewanted.com/set_partner_userid_get/spotx/$SPOTX_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=178357&redir=https://csync.smilewanted.com/set_partner_userid_get/spotx/$SPOTX_USER_ID&__user_check__=1&sync_id=056dada1-fefb-11ec-bb3f-1df272450503
https://csync.smilewanted.com/set_partner_userid_get/spotx/056dad1e-fefb-11ec-bb3f-1df272450503

0
503 B

135ms
134ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/spotx/056dad1e-fefb-11ec-bb3f-1df272450503
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b813fcf19e6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain
Date: Fri, 08 Jul 2022 20:17:42 GMT
Location: https://csync.smilewanted.com/set_partner_userid_get/spotx/056dad1e-fefb-11ec-bb3f-1df272450503
Server: nginx
X-fe: 277

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B6C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDzHTUI0cR-zFomuMCCpPlA&google_cver=1&gdpr=0

43 B
61 B

41ms
40ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDzHTUI0cR-zFomuMCCpPlA&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNX3Ap5O2jdTyeP-ratLxnxWxpxcW6eUjX1Z5zxEmtFna6qu9igoMx2j2gmzLhy-roOWmcA1r2LMzufvLPImQNlavgHRX5Yw4hxlWFPqjJCdSXbNIik
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDzHTUI0cR-zFomuMCCpPlA&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B6C6
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTZjYjZkNmMtMGU4OC02YjIxLTU0MmItYWI2ZGYwZjdjZDUw

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTZjYjZkNmMtMGU4OC02YjIxLTU0MmItYWI2ZGYwZjdjZDUw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNX3Ap5O2jdTyeP-ratLxnxWxpxcW6eUjX1Z5zxEmtFna6qu9igoMx2j2gmzLhy-roOWmcA1r2LMzufvLPImQNlavgHRX5Yw4hxlWFPqjJCdSXbNIik

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: gzip
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTZjYjZkNmMtMGU4OC02YjIxLTU0MmItYWI2ZGYwZjdjZDUw
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame B6C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
https://sync.teads.tv/um?eid=3&uid=CAESEAuGglG6SyFtQsZ0mcCqaOI&google_cver=1&gdpr=0

23 B
172 B

31ms
30ms

Image
image/gif

104.76.101.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEAuGglG6SyFtQsZ0mcCqaOI&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNX3Ap5O2jdTyeP-ratLxnxWxpxcW6eUjX1Z5zxEmtFna6qu9igoMx2j2gmzLhy-roOWmcA1r2LMzufvLPImQNlavgHRX5Yw4hxlWFPqjJCdSXbNIik
Protocol: H2
Server: 104.76.101.133 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-101-133.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cache-control: max-age=0, no-cache, no-store
expires: Fri, 08 Jul 2022 20:17:42 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEAuGglG6SyFtQsZ0mcCqaOI&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 292
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B6C6
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=Yjg2ZmIyYzYtOTU4MC00ZDFjLWEwZDktMGI4YzY2NjNjMjhj

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=Yjg2ZmIyYzYtOTU4MC00ZDFjLWEwZDktMGI4YzY2NjNjMjhj

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: akka-http/10.2.7
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=Yjg2ZmIyYzYtOTU4MC00ZDFjLWEwZDktMGI4YzY2NjNjMjhj
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9BBA 0
0 58ms
58ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CZ9wh5ZDIYo3dHZjnnwTerr7wD-ySrZFg99rS06wMwI23ARABIABgyYb_h_Cj7BKCARdjYS1wdWItODY3NjU2MDU5ODI5NjY4MqABlfWb3wPIAQngAgCoAwGqBP0BT9BNcMInQcl4ZoEp-KtDVZmV_KYQFluOrhBwA_teGEbF8WSPPAkfYDaEJCfLkV4YKdrXm3JJTxcbC_jw9O5XIE2dleKYtity3qn7xPIfpzuQ2KBbJS2bZgf_lfWWqL6LgQLGBpPU_U7ShHLxP5iWNz7jp67iPyCAybkbQ5w6DC7Oh07mjah26rRMkvdJy4VKcA5H6QA8LIJEoT_xORnYIVOqciFluKxnYd4os4tuk7cGlWN2yCrnm-oVS833IonDxKgkIjoPeY-y5Kmr8C4-ayacs5EdA6QMWS2zYv30pgPdlWS9JiDchakv-WKl0oOzFobCSfHB-jiDG-V7ruAEAYAGhbiQ7uT7qp-mAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTg2NzY1NjA1OTgyOTY2ODIYgt8i&sigh=tmFdbnGF5VY&uach_m=[UACH]&cid=CAQSPACNIrLMqQuX_VmPDrYA2xJiMY5j-E7oF9hlb6QeRtsWCtE7SePzb49TIVJmvGJyOV2korDA7A0zW_BuYBgB
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 log
hblg.media.net/ Frame 9BBA 35 B
0 24ms
18ms Fetch
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hblg.media.net/log?logid=kfk&evtid=l1log&app=0&cc=US&ctr=0.0&viewability=51&device_id=4&cbdp=0.102&slotVisibility=1&dn=xmod.in&acid=00fd9a5a68c5437cb1f7f84b94aaa1f2&ugd=4&size=728x90&pvid=294&csip=rtb-appnexus-7cfb9985db-885jb.SC&ogbdp=0.15&prvReqId=39940985460180_999781551_11621109112941&itype=ADX&requrl=https%3A%2F%2Fxmod.in%2Fblog&scrid=1700080812897200728009000001000&mang=1&bidrestime=1657311461594&cid=8CUU9JF8H&rme=nurl
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame 9BBA 35 B
0 23ms
19ms Fetch
image/gif 23.219.92.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&ckfl=0&lper=&app_type=adx&bdr_typ=1&ss_d1=0&ogerpm=0.1500&ss_d2=0&stid=&other_prv=294&jar_err=&current_day=5.0&adtyp=0&req_id=YsiQ5QAIXDcKh-eP0QiQyQ&bd_m3=0.0000&bidfp=0.0100&bd_m2=0.0000&pvag_id=&bd_m1=0.0000&ugd=4&dim10=false&predicted_wr=73.4399&exp=&second_bidder=*&search_res=32&floor_bucket=0.00&gpid_format=&seat=BID_API&size=728x90&url_l1=blog&f_seg=segment_broad_technology_computing&prdp=0.1020&ogcbdp=0.1500&dfpbd=0.1020&server=1&ogerpm_wd_bkt=0-1&model_version=202207081116_generic_adx_1-cid_0&viewability=0.5100&dmm_r=0.0000&cut=32&dmm_l=0.0000&as_cache=1&tcyerpm=&sc=IL&send_erpm=true&dmm_m9=0.0000&sd=2&hb_exp=&seg=arc_health_8%2CComputing%2Ccpa_auto_ins_pop_cat%2Ccpa_auto_ins_pop_cat_mixed%2Ccpa_wheels_ap%2CInternet%2Csegment_broad_technology_computing%2CSocial_Networking%2CTechnology_and_Computing&dmm_m4=0.0000&erpm_bucket=0.15&ugd_ver=&requrl=xmod.in%2Fblog%2F&bidrestime=1657311461594&cc=US&strg=harmony&ss=&current_hour=20&time_stamp=2022-07-08+20%3A17%3A41&model_key=generic_adx_1-cid_0&rvshhon=&mul_ratio=0.0000&bdp=0.1500&ct=Chicago&akey=&mnckfl=0&bdp_bucket=0.15&algo=&dc=east_sc&splid=&dn=xmod.in&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F103.0.5060.53+Safari%2F537.36&buyer_id=&bdp_wider_bucket=1&acid=00fd9a5a68c5437cb1f7f84b94aaa1f2&infl=&o_ver=NT+10.0&br_ver=103.0.5060.53&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m5=0.0000&ver=8.12.0&totalTimeBucket=2&visibility=1&totalTime=2574660&dmm_m1=2022-07-08+20%3A17%3A41.595407699&e_rpm=0.0000&dmm_m22=0.1500&gdpr=&vsid=&log_less=true&gpid_sent=false&ogerpm_used=false&bdmm_m12=0.0000&cid=8CUU9JF8H&bcrid=1700080812897200728009000001000&rawbid=0.1500&seat_id=BID_API&sub_bidder=196&pst=EMS&pbshr=100.0000&dmm_d10=&o_id=101&clisp=rtb-appnexus-7cfb9985db-885jb.SC&dfp_bucket=0.1&adblk=740958930&itype=adx&pvid_seat=294_BID_API&cliIP=2503514368&advurl=search.yahoo.com%2F&level_base=0&crid=116211091&sat=1&br_id=265&cut_bkt=30&gpid=&iwb=1&second_bid=0.000000&sc_pvid=294&capd=0&other_bids=0.15
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.219.92.153 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-219-92-153.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame 9BBA 159 KB
55 KB 62ms
57ms Script
text/javascript 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

59dcda2a1ce6700b78caeb65b1da20972a94ed42618e737b737d5d3033c99c60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-mnt-h: 21-6005
content-encoding: gzip
etag: "5b6386cd34f16b09783f941fc0e33c38"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Fri, 08 Jul 2022 20:17:42 GMT
x-cache-hits: 0
strict-transport-security: max-age=31536000
x-mnt-w: 8-8
expires: Fri, 08 Jul 2022 20:22:42 GMT

GET
H2 200 adperformance.js Show response
warp.media.net/rtb/resource/ Frame 9BBA 61 KB
62 KB 28ms
22ms Script
application/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resource/adperformance.js?v=35e90bcdc8

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

3378135f525fc551ce49d2c117e9967735794757a4c71910d8c1b8fa38bf3f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=604800
server: nginx
date: Fri, 08 Jul 2022 20:17:42 GMT
content-type: application/javascript;charset=ISO-8859-1
cache-control: max-age=53697
access-control-allow-credentials: true
content-length: 62892
expires: Sat, 09 Jul 2022 11:12:39 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 9BBA 3 KB
1 KB 24ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 763
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9BBA 137 KB
42 KB 45ms
41ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame 9BBA 17 KB
7 KB 25ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9BBA 0
0 41ms
37ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaST8lnT7XZerzNTUY9y7RuWcA4RzO6g3wPpsdnu14wiCKylFXc_W6ygujkuBTUghLywjcFPRlIt1w_hPcmLS-VQ2wYjNw
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 9BBA 22 KB
7 KB 25ms
21ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 06:34:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222172
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 06 Jul 2023 06:34:50 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame A58E
Redirect Chain

https://pixel.sitescout.com/dmp/pixelSync?network=EPLANNING&rurl=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fuid%3D%7BUSER_ID%7D%26dc%3D0abbcb4eba840e59%26fi%3D43c40cadbd39e3cd
https://u-iad04.e-planning.net/um?uid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&dc=0abbcb4eba840e59&fi=43c40cadbd39e3cd

42 B
103 B

24ms
24ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?uid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&dc=0abbcb4eba840e59&fi=43c40cadbd39e3cd
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://u-iad04.e-planning.net/um?uid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&dc=0abbcb4eba840e59&fi=43c40cadbd39e3cd
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

um
sync.e-planning.net/ Frame A58E
Redirect Chain

https://sync.1rx.io/usersync2/eplanning
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=110&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fcentro%2F2095%2F%7BuserId%7D%3Fzcc%3D0%26sspret%3D1&rndcb=409611767
https://sync.1rx.io/usersync3/centro/2095/a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341?zcc=0&sspret=1&rndcb=409611767
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3DRX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005%26dc%3D1079...
https://sync.e-planning.net/um?uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005&dc=1079cc634ca638f8&iss=1

42 B
103 B

34ms
16ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005&dc=1079cc634ca638f8&iss=1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: openresty
content-type: image/gif

Redirect headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Tengine
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://sync.e-planning.net/um?uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005&dc=1079cc634ca638f8&iss=1
Connection: keep-alive
Content-Type: text/html

GET
H2

200

um
u-iad04.e-planning.net/ Frame A58E
Redirect Chain

https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeebd%26fi%3D43c40cadbd39e3cd%26uid%3D%24%7BUID%7D
https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=43c40cadbd39e3cd&uid=837a3169-7e60-066c-2a47-31c1bb4ec1bd

42 B
103 B

22ms
22ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=43c40cadbd39e3cd&uid=837a3169-7e60-066c-2a47-31c1bb4ec1bd
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:41 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=43c40cadbd39e3cd&uid=837a3169-7e60-066c-2a47-31c1bb4ec1bd
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: qu0t0v4gr61lngv6a3o7injlbks267ds

GET
H/1.1 200 ptag Show response
a.audrte.com/ Frame A58E 5 KB
2 KB 29ms
27ms Script
text/plain 54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptag?p=M1353665098
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: bd8ccf8e3f2a53ec9bdbd3582a0a03bb9110fc4b3ad7586c05974cb2af42a953

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-transform, public, max-age=3600
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1682

GET
H2 200 lotame20220615.js Show response
s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/ Frame A58E 566 B
520 B 24ms
22ms Script
application/x-javascript 172.98.26.121
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.121 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 4f618d20d85f3163d72432606f3afa3c17b6c79954f967ec3df9a710503c9df4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: gzip
last-modified: Wed, 15 Jun 2022 16:21:31 GMT
server: openresty
etag: W/"62aa070b-236"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Wed, 07 Jul 2027 20:17:42 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame A58E
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3D43c40cadbd39e3cd%26uid%3D%24UID
https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=43c40cadbd39e3cd&uid=2840070346914927031

42 B
103 B

23ms
22ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=43c40cadbd39e3cd&uid=2840070346914927031
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: eef5ecb4-4c75-4f31-8fba-d1ddcd7757a8
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=43c40cadbd39e3cd&uid=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame A58E
Redirect Chain

https://sync.go.sonobi.com/us?loc=%0A%0Ahttps%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3De52415579699e09f%26fi%3D43c40cadbd39e3cd%26uid%3D%5BUID%5D
https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=43c40cadbd39e3cd&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4

42 B
103 B

24ms
23ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=43c40cadbd39e3cd&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-117
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=43c40cadbd39e3cd&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame A58E
Redirect Chain

https://cs.emxdgt.com/um?ssp=pbs&gdpr=0&gdpr_consent={{.GDPRConsent}}&us_privacy={{.USPrivacy}}&redirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dd87251d0debad578%26fi%3D43c40cadbd39e3cd%26...
https://u-iad04.e-planning.net/um?dc=d87251d0debad578&fi=43c40cadbd39e3cd&uid=2840070346914927031brt64371657311461469722af

42 B
103 B

22ms
22ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=d87251d0debad578&fi=43c40cadbd39e3cd&uid=2840070346914927031brt64371657311461469722af
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

Redirect headers

location: https://u-iad04.e-planning.net/um?dc=d87251d0debad578&fi=43c40cadbd39e3cd&uid=2840070346914927031brt64371657311461469722af
date: Fri, 08 Jul 2022 20:17:41 GMT
content-length: 0
content-type: text/html

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 981C 31 KB
10 KB 40ms
37ms Script
text/html 23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4a411ecc4f2769a81a8f2fc5a796ae019bbaa0ca05aa70ef91d7029e6a3f54b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=17184-d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=50003
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9455
Expires: Sat, 09 Jul 2022 10:11:05 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3047 0
26 B 37ms
36ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

jfygCZAsX3_URbCTyFTB Show response
csync.smilewanted.com/set_partner_userid_get/outbrain/ Frame 059B
Redirect Chain

https://b1sync.zemanta.com/usersync/smilewanted?gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Foutbrain%2F__ZUID__
https://stags.bluekai.com/site/23178?id=jfygCZAsX3_URbCTyFTB&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3TPFXGGLTTNVUWYZLXMFXHIZLEFZRW63JPONSXIX3Q...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3TPFXGGLTTNVUWYZLXMFXHIZLEFZRW63JPONSXIX3QMFZHI3TFOJPXK43FOJUWIX3HMV2C633VORRHEYLJNYXWUZTZM5BVUQLTLAZV6VKSMJBVI6KGKRBD6ZLYMNUGC...
https://csync.smilewanted.com/set_partner_userid_get/outbrain/jfygCZAsX3_URbCTyFTB?gdpr=0

0
488 B

125ms
125ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/outbrain/jfygCZAsX3_URbCTyFTB?gdpr=0
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b81404fabe6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 112
Content-Type: text/html; charset=utf-8
Date: Fri, 08 Jul 2022 20:17:42 GMT
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Location: https://csync.smilewanted.com/set_partner_userid_get/outbrain/jfygCZAsX3_URbCTyFTB?gdpr=0
P3p: CP="We do not support P3P header."
Pragma: no-cache

GET
H2

200

sync
partners.tremorhub.com/ Frame 6150
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm&gdpr=0
https://partners.tremorhub.com/sync?UIGL=CAESEOlLl9VQdTiQA17TmmsWPS0&google_cver=1&gdpr=0

43 B
183 B

108ms
23ms

Image
image/gif

2600:1f18:612b:4200:ab32:caca:8052:ebbb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEOlLl9VQdTiQA17TmmsWPS0&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjYrIHMATAB&v=APEucNXBVL374Hk3Lh_fvY2dVJUWb9X1GZpUPIZzNlXTaQVrQ7ENt6pxONSkYixFH8ZHKnMl94d9klLktRpyWGGve8NVnh8EE-PVCxZNKR-nLwCbKDSSJpE
Protocol: H2
Server: 2600:1f18:612b:4200:ab32:caca:8052:ebbb Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://partners.tremorhub.com/sync?UIGL=CAESEOlLl9VQdTiQA17TmmsWPS0&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 294
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 6150
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm&gdpr=0
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEOLlZ7KnuG0FUms-Kr-JjQI&google_cver=1

43 B
549 B

73ms
29ms

Image
image/gif

192.35.249.120
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEOLlZ7KnuG0FUms-Kr-JjQI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjYrIHMATAB&v=APEucNXBVL374Hk3Lh_fvY2dVJUWb9X1GZpUPIZzNlXTaQVrQ7ENt6pxONSkYixFH8ZHKnMl94d9klLktRpyWGGve8NVnh8EE-PVCxZNKR-nLwCbKDSSJpE
Protocol: HTTP/1.1
Server: 192.35.249.120 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 395
Connection: keep-alive
Content-Length: 43

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEOLlZ7KnuG0FUms-Kr-JjQI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 317
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6150
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MDU2ZGFkMWUtZmVmYi0xMWVjLWJiM2YtMWRmMjcyNDUwNTAz

170 B
188 B

37ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MDU2ZGFkMWUtZmVmYi0xMWVjLWJiM2YtMWRmMjcyNDUwNTAz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjYrIHMATAB&v=APEucNXBVL374Hk3Lh_fvY2dVJUWb9X1GZpUPIZzNlXTaQVrQ7ENt6pxONSkYixFH8ZHKnMl94d9klLktRpyWGGve8NVnh8EE-PVCxZNKR-nLwCbKDSSJpE

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MDU2ZGFkMWUtZmVmYi0xMWVjLWJiM2YtMWRmMjcyNDUwNTAz
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 276
Connection: keep-alive
Content-Length: 0

POST
H/1.1 200 899.json Show response
id5-sync.com/g/v2/ 451 B
1 KB 102ms
101ms XHR
application/json 141.95.98.71
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/899.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161325/6083/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.71 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

bb950df251c89a12f1a75493be02b313e25db051d12a9ab891ca8ef00d7cca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:41 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
p3p: CP="CAO PSA OUR"
access-control-allow-origin: https://xmod.in
access-control-allow-credentials: true
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8
transfer-encoding: chunked

GET
H2 200 id Show response
id.crwdcntrl.net/ 154 B
524 B 31ms
30ms XHR
application/json 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161325/6083/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a7c50ce8b149a36ae3e302ada563915fe7dc9f908d6bd5ba3e80c0505281a8eb

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://xmod.in
cache-control: no-cache
x-server: 10.40.1.61
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 154
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
713 B 25ms
24ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/161325/6083/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 03a0e3b9fafcafdaafd8413ce306762c7dc78cb31027af16995d9cd8e5741fc8

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://xmod.in
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Sun, 07 Aug 2022 20:17:42 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 481A 1 KB
753 B 20ms
20ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3336
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 AGSKWxUv4ITHAc9jZiBxXotpeaXEBOe6skL8jdIGqbc7sb-5674fiaLtYA0K2f8EO9dx9TzohqHR3JzRLlKHg7SjAxqlEzyh_2fx1Bq7X_dKNcvf-QLUMRZ6acKiyhLZcZMIB0BTY5P9XKICQDmv7fjJxE1ckYU4tliBVhFNLAwgXzhFSNNB6xJg46l3KcLx Show response
fundingchoicesmessages.google.com/f/ 54 KB
20 KB 60ms
59ms Script
application/javascript 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUv4ITHAc9jZiBxXotpeaXEBOe6skL8jdIGqbc7sb-5674fiaLtYA0K2f8EO9dx9TzohqHR3JzRLlKHg7SjAxqlEzyh_2fx1Bq7X_dKNcvf-QLUMRZ6acKiyhLZcZMIB0BTY5P9XKICQDmv7fjJxE1ckYU4tliBVhFNLAwgXzhFSNNB6xJg46l3KcLx?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjU3MzExNDYyLDI0ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly94bW9kLmluL2Jsb2cvIixudWxsLFtdXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabTcfV2SignalJs.en_US.jZCwsJAhaPw.es5.O/d=1/rs=AJlcJMxJp8bk6PSply88X1hkdNXLhnBo7w/m=iabtcfv2signalscript

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

515778dfd67361e7ac8da7368c2f4eaeecd59aa5bff550300f7dbd72ccf7044c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-zx-EMt8Ib6AMpiICRcjEuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-zx-EMt8Ib6AMpiICRcjEuQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-zx-EMt8Ib6AMpiICRcjEuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-zx-EMt8Ib6AMpiICRcjEuQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4DBB 1 KB
753 B 20ms
19ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3336
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 69AF 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9c864a0b0f1f41432785b9012e09354177d21fb14796613d853ba19cd02366d

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame F8C3
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2840070346914927031

43 B
915 B

48ms
47ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2840070346914927031
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8140e85ca23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wFztVowqJX4eBxuar2TkC9vCQUcFs6cBZNJK0L6%2BlesNkIAEJz8bFGr0Hx0Ko1Y2Vm8B%2FtoI3%2B4G%2Ff5kq%2FG77U%2Fu4Tpg5ezcjj3WvIrFBT%2F%2BfV8XXsGwzIE4AcFzCNjbEJ58iG%2BggyNWyA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 99aa1b2e-3274-4950-9fea-5a9472cee17a
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F8C3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YsiQ5AAO0ntNvgAo

43 B
915 B

62ms
61ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YsiQ5AAO0ntNvgAo
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8140e858a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zyMzN49FIn%2F0JAKi%2FDlrh9eHl49oK5UA6PpF3JWLY1XtVsoEq%2B%2BXz6sbU9RwJG3Dy90sVMtd7xisFsNmXl%2F9VeR5I5fB%2BhMKZ9Vu1LkZ2Ksq%2FEJl%2FCXCb%2FCG03wsgSYI5GI9FUI7RxPBOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1657311462.329174,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YsiQ5AAO0ntNvgAo
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame F8C3
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB

43 B
992 B

27ms
27ms

Image
image/gif

2600:1f18:4e9:5a02:357b:502f:f800:1eb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

Server

2600:1f18:4e9:5a02:357b:502f:f800:1eb Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
date: Fri, 08 Jul 2022 20:17:42 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame F8C3
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABZSU7FkSIAABCcZS66OQ&expiration=1658521062

43 B
907 B

49ms
47ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABZSU7FkSIAABCcZS66OQ&expiration=1658521062
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8142298fa23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3jauZ4Mf6rN2ay8HK1CiHYqJVwQ1fV%2BbKdAGQtNuRpqpDAGFk9HbczFVx6fVp842LB1iAOABrCP2TzwPUrGQnymInzDnkSpX4KKXwaVwlVye%2FTUk7SjIJ0qPr6AcYBvKTN2V%2BByeN59Png%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABZSU7FkSIAABCcZS66OQ&expiration=1658521062
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame F8C3 0
34 B 26ms
23ms Image
text/plain 54.146.231.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.231.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-231-30.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3

200

crum
dsum.casalemedia.com/ Frame F8C3
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2840070346914927031

43 B
934 B

84ms
62ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2840070346914927031
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b814228dea228-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JxeRqPymwXx0UWMXBneMRNSJujmrq70jJYwwJg47MWo4w3EnELvzN0Uty%2FD6OR46WnY2WiI6lDyB96BuGWp8AWtRF3z%2BPSjA3MCzNGvpAP61DBiT%2BEt6bfzODmslixYuDgkmqg7B"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: d2e721f7-02d7-4684-bea5-b7060fb2e1f8
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame F8C3
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=
https://stags.bluekai.com/site/23178?id=jfygCZAsX3_URbCTyFTB&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3S...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD22TGPFTUG...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=jfygCZAsX3_URbCTyFTB

43 B
910 B

77ms
60ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=jfygCZAsX3_URbCTyFTB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8144ac63a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G2tG66NvfPro%2ByWtZdJFEK%2F0JTsLz8CQGr9KrYuKyfdgfBaic7mztlO5vlNcOEG1EnmEq%2BNEkpxP7j6MbeDn1iBWeOejo5qML%2FWYZiFre%2F18XI5XPhnLtCB1wE0QCz51D%2B6gtMuBQB7pVA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
P3p: CP="We do not support P3P header."
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=jfygCZAsX3_URbCTyFTB
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 115
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame F8C3
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=Nwgrv8Xp1O9Uq05

43 B
903 B

62ms
60ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=Nwgrv8Xp1O9Uq05
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8142097ea23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tkc5t%2Ft6%2FTGSndTGOxdjy7CnIO2u0A8jDSpronmrnXP3BCVUfFqedXANnblrO5DOtGcNkabjSWu5XwIOg1G3zJwrvpgt2e50Ath9S02aEicDJCwzpkT6TTYbcs1BdGzwSQbcTSPDldzsmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: PingMatch/658332f#658332fc5aaa95d8a9be88d89d84d3c319923363 i-0c5b175b45d77b935@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=Nwgrv8Xp1O9Uq05
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 setuid
sync.quantumdex.io/ Frame F8C3 43 B
95 B 36ms
34ms Image
image/gif 2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=ix&uid=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b8140c885ca47-YUL
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E63E 6 KB
3 KB 19ms
19ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame 6E9F
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7517899671563583421

0
406 B

20ms
20ms

Document
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7517899671563583421
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:41 GMT
Etag: 5af40ae811d41453
Server: VertaMedia 1.0

Redirect headers

content-length: 0
content-type: text/plain
date: Fri, 08 Jul 2022 20:17:42 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7517899671563583421
server: nginx

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6CC3
Redirect Chain

https://sync.console.adtarget.com.tr/csync?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D318342%26extuid%3D%7Buid%7D
https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453

0
387 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Location: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453
Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 5af40ae811d41453
Content-Length: 0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 2042
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=eplanning_east&endpoint=us-east
https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east

281 B
554 B

50ms
45ms

Document
text/html

23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:42 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 08 Jul 2022 20:17:42 GMT
location: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B3FA 15 KB
6 KB 20ms
19ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D43c40cadbd39e3cd%26uid%3D

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52837
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H3 200 usermatch Show response
ssum.casalemedia.com/ Frame 5E65 2 KB
2 KB 88ms
65ms Document
text/html 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5196fe74c9350123d67a99e30b59e37bea98d62c21f07da960a269d900855ed

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 727b81400a7da1e1-YYZ
content-encoding: br
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
dropped-udsids: 3|4|65|64|73|88|195|57
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sILg4akec3nFOw9Cb3%2Bw6h8HvD9dfMuomAa7aMP4g7zlnJP%2Bk8QTP00TDWVmNHrraMb0T35Grdmn%2BV%2FASwp%2FLlQMRUucu6yeFA0ZTAoGpfkONcXaZgkA7U0l67X5lx8JDegES4Yu"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

GET
H2 200 navegg_2022_01_br.html Show response
i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/ Frame 84B0 1 KB
987 B 113ms
112ms Document
text/html 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/navegg_2022_01_br.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 Leesburg, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: fda04c7b27b3db6bda165e1d1324e7c475edc1f3cc06e927a78f739d74992fcb

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=157680000
cf4age: 0
cf4ttl: 157680000.000
content-encoding: gzip
content-length: 624
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
etag: W/"61ddbb71-5f5"
expires: Mon, 21 Jun 2027 11:13:51 GMT
last-modified: Tue, 11 Jan 2022 17:16:33 GMT
server: CFS 0215
x-cf-rand: 20.214
x-cf-tsc: 1655896432
x-cf1: 29080:dB.waw1:co:1585621119:cacheN.waw1-01:D
x-cf2: H
x-cf3: M
x-cff: B

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 8DBA 2 KB
814 B 12ms
12ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5927d926323dc2c

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 204 /
spl.zeotap.com/ Frame 3BCF 0
0 51ms
50ms Document
text/plain 2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 727b813fed404bb9-YUL
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
via: 1.1 google

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3781 1 KB
753 B 20ms
19ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3336
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 602A 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e9323009507186e1cc03af3aa3f6b1613b572ad8e77b51e3615b8f7a47c9c75

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CF1 0
26 B 36ms
35ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame E072
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

19ms
18ms

Document
text/html

23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: about:blank
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:42 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 08 Jul 2022 20:17:42 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H3

200

match
events-ssc.33across.com/ Frame ACF4
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=70b3e8d7-cc97-480b-80ee-dad476c341d7&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=254dd7d3-92b7-4826-982b-da30ccf966f8
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=254dd7d3-92b7-4826-982b-da30ccf966f8&ts=1657311463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

27ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=254dd7d3-92b7-4826-982b-da30ccf966f8&ts=1657311463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: unsafe-url
server: 33XP001
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=254dd7d3-92b7-4826-982b-da30ccf966f8&ts=1657311463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame ACF4
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1657311461940.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fe...
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=bea062c8-90e4-4c00-bf77-b3eaa870d307

68 B
82 B

74ms
48ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=bea062c8-90e4-4c00-bf77-b3eaa870d307
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x34 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=bea062c8-90e4-4c00-bf77-b3eaa870d307
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame ACF4
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-MxpP99tE2uGmS3adAcpbYCZxZAAs4rXI~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-MxpP99tE2uGmS3adAcpbYCZxZAAs4rXI%7EA&ts=1657311462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
225 B

110ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-MxpP99tE2uGmS3adAcpbYCZxZAAs4rXI%7EA&ts=1657311462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-MxpP99tE2uGmS3adAcpbYCZxZAAs4rXI%7EA&ts=1657311462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame ACF4
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=79c17fc1c1db122c&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGdAkJcE92-QN_M-pzAAAAAAA&expiration=1657397862&is_secure=true&us_privacy=
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAGdAkJcE92-QN_M-pzAAAAAAA&ts=1657311462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

37ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAGdAkJcE92-QN_M-pzAAAAAAA&ts=1657311462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAGdAkJcE92-QN_M-pzAAAAAAA&ts=1657311462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame ACF4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1659903462%26external_user_id%3D70b3e8d7-cc97-480b-80ee-dad476c341d7
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1659903462&external_user_id=70b3e8d7-cc97-480b-80ee-dad476c341d7

68 B
225 B

109ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1659903462&external_user_id=70b3e8d7-cc97-480b-80ee-dad476c341d7
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 40000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1659903462&external_user_id=70b3e8d7-cc97-480b-80ee-dad476c341d7
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8596
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=0&redir=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS10djdDMFlaRTJ1R1V1R1FIOWlPSVBlUzUzTDZqYi5tUn5B&gdpr=0&gdpr_consent=

170 B
188 B

35ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS10djdDMFlaRTJ1R1V1R1FIOWlPSVBlUzUzTDZqYi5tUn5B&gdpr=0&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjYrIHMATAB&v=APEucNWi5-5iX9HLks2WbzZmpiltQrc4iMH7iAHbBA3TdSZ45j1hvX4q6tW1-pMlhfFSQ9BlwbfzV5SlfGTm4bvAvn81MKXqQpTrcKF3bdXyy6Aw0OZvO1A

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS10djdDMFlaRTJ1R1V1R1FIOWlPSVBlUzUzTDZqYi5tUn5B&gdpr=0&gdpr_consent=
date: Fri, 08 Jul 2022 20:17:42 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

user-registering
ads.stickyadstv.com/ Frame 8596
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=0
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEMN_8S9GdqVMFv7zJ4sUmF8&google_cver=1&gdpr=0

43 B
678 B

266ms
79ms

Image
image/gif

63.251.28.218
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEMN_8S9GdqVMFv7zJ4sUmF8&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjYrIHMATAB&v=APEucNWi5-5iX9HLks2WbzZmpiltQrc4iMH7iAHbBA3TdSZ45j1hvX4q6tW1-pMlhfFSQ9BlwbfzV5SlfGTm4bvAvn81MKXqQpTrcKF3bdXyy6Aw0OZvO1A
Protocol: HTTP/1.1
Server: 63.251.28.218 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1657311462860055-302

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEMN_8S9GdqVMFv7zJ4sUmF8&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 328
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8596
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=11
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTgzNWU5NTFkZWU0NGUxZjZmZGEyNDc1ZjQzYmUyN2U=&gdpr=0&gdpr_consent=

170 B
188 B

66ms
39ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTgzNWU5NTFkZWU0NGUxZjZmZGEyNDc1ZjQzYmUyN2U=&gdpr=0&gdpr_consent=

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTgzNWU5NTFkZWU0NGUxZjZmZGEyNDc1ZjQzYmUyN2U=&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1657311462859066-286

GET
H2

200

um
sync.e-planning.net/ Frame BF8C
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=eplanning_east&khaos=L5CWGBJG-1Y-B9H5
https://sync.e-planning.net/um?uid=L5CWGBJG-1Y-B9H5&dc=9bcc91305985f0db&iss=1

42 B
103 B

27ms
26ms

Image
image/gif

172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?uid=L5CWGBJG-1Y-B9H5&dc=9bcc91305985f0db&iss=1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://sync.e-planning.net/um?uid=L5CWGBJG-1Y-B9H5&dc=9bcc91305985f0db&iss=1
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: d5a7ef20801cf5cb1ee516b6110e672f
Expires: 0

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame DCF8 6 KB
3 KB 19ms
19ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3047 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28187321d1675835a17cd5eae7e466d0c6946ff1768ac80078cd1e7df13fac66

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7FC0 22 KB
8 KB 20ms
20ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 92722
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Jul 2022 18:32:20 GMT
expires: Fri, 07 Jul 2023 18:32:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 smtr Show response
contextual.media.net/ Frame 79C8 65 KB
27 KB 383ms
382ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TV51ISA&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311462524544321&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=8fOnRrolnfOur8B4zx%2FBge4B&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808128972&kapc=7&ekals=775EJvu99ui%7C%7CENvh%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2b6c822ad9fe1ad737fbc2d4055812c303740f2c047c4aee7e694ecae0dd9502

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 27153
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
expires: Fri, 08 Jul 2022 20:17:42 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-sc-h: 21-0p5i
x-sc-w: 21-qk7k

GET
H2 200 bping.php
lg3.media.net/ Frame 9BBA 35 B
189 B 20ms
19ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=531&&gdpr=0&prid=8PRN625DH&cid=8CU5RJ1PV&crid=764724967&vi=1657311462524544321&ugd=4&lf=6&cc=CA&sc=QC&vsid=3003130611454751&lper=100&wsip=2886781036&r=1657311462612&requrl=https%3A%2F%2Fxmod.in%2Fblog&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=16276&vgd_rakh=1657311462167061077&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_pgid=p1947862235t202207082017&vgd_pgids=1&vgd_uspa=0&hvsid=00001657311462608025035145474926&gdpr=0&vgd_end=1

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:42 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FFD0 1 KB
753 B 20ms
19ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3336
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 1 Show response
sync-eu.connectad.io/syncer/ Frame 0C5A 5 KB
2 KB 132ms
120ms Document
text/html 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by: Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a24b2445a52f7840e7cd8b3383b75a9a6ee4114ae8c280e328e16504a63fc930

Request headers

Referer: https://cdn.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status: DYNAMIC
cf-ray: 727b814198af713e-YUL
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0358 22 KB
8 KB 20ms
19ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 92722
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Jul 2022 18:32:20 GMT
expires: Fri, 07 Jul 2023 18:32:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 0B74 15 KB
6 KB 57ms
56ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156813&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID

Requested by

Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52837
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 638F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17184-d
https://eus.rubiconproject.com/usync.html?p=17184-d

281 B
554 B

19ms
18ms

Document
text/html

23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:42 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 08 Jul 2022 20:17:42 GMT
location: https://eus.rubiconproject.com/usync.html?p=17184-d
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame E270 2 KB
814 B 14ms
12ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=75a1922f904cc20

Requested by

Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://s.adtelligent.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK csync
sync.adtelligent.com/ Frame 4D71 43 B
323 B 19ms
17ms Image
image/gif 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?redir=
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:41 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 43
Content-Type: image/gif

GET
H2

200

cksync
cs.media.net/ Frame 2E8A
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=6&google_nid=media&google_cm=1&google_hm=MzAwMzEzMDYxMTQ1NDc1MTAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEOSL_Wr3HcnY4Nx3hVS5D38&google_cver=1

45 B
446 B

37ms
34ms

Image
image/gif

96.16.28.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEOSL_Wr3HcnY4Nx3hVS5D38&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C4%2C20000%2C313%2C10000%2C9%2C319%2C294&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1
Protocol: H2
Server: 96.16.28.28 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-28-28.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Fri, 08 Jul 2022 20:17:42 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEOSL_Wr3HcnY4Nx3hVS5D38&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BF8C
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDVDV0dCSkctMVktQjlINQ==

170 B
188 B

49ms
46ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDVDV0dCSkctMVktQjlINQ==

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDVDV0dCSkctMVktQjlINQ==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 2dd9fa24169fa04536d533da131679f8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame BF8C 43 B
932 B 486ms
175ms Image
image/gif 52.94.220.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.94.220.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: EDZ6BPX98SQCXF6V50D9
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BF8C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEMKUG-o4bQds6Sa_k-8UZYU&google_cver=1

42 B
741 B

110ms
24ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEMKUG-o4bQds6Sa_k-8UZYU&google_cver=1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEMKUG-o4bQds6Sa_k-8UZYU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

esync
token.rubiconproject.com/ Frame BF8C
Redirect Chain

https://id.rlcdn.com/709414.gif
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e

0
214 B

52ms
27ms

Image
text/plain

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 2dd9fa24169fa04536d533da131679f8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame BF8C
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=pNdgVJcAQqGXKcMrY4Ub9A&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=pNdgVJcAQqGXKcMrY4Ub9A

43 B
556 B

44ms
30ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=pNdgVJcAQqGXKcMrY4Ub9A

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 3AWHBT80GKZ810NJTBYZ
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=pNdgVJcAQqGXKcMrY4Ub9A
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

204

v1
ads.yahoo.com/cms/ Frame BF8C
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L5CWGBJG-1Y-B9H5&sigv=1&esig=2~cc0ddcfbf6ab4a83145ab9130146389b85bc0994

0
194 B

129ms
23ms

Image
text/plain

2001:4998:1c:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L5CWGBJG-1Y-B9H5&sigv=1&esig=2~cc0ddcfbf6ab4a83145ab9130146389b85bc0994

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Server

2001:4998:1c:800::1001 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L5CWGBJG-1Y-B9H5&sigv=1&esig=2~cc0ddcfbf6ab4a83145ab9130146389b85bc0994
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BF8C
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/6WNlHThD4gZsMwV7Ezs7FMn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3476349519459380111

42 B
741 B

251ms
250ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3476349519459380111
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Content-Type: image/gif

Redirect headers

date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3476349519459380111
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BF8C
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjYzOTE3ZGRkNTc3ZTQ5YTM4MTMzNjYyZjM2ZmJkZTU1NjIyZjA1NQ

170 B
188 B

49ms
46ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjYzOTE3ZGRkNTc3ZTQ5YTM4MTMzNjYyZjM2ZmJkZTU1NjIyZjA1NQ

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjYzOTE3ZGRkNTc3ZTQ5YTM4MTMzNjYyZjM2ZmJkZTU1NjIyZjA1NQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame BFB0 26 KB
9 KB 61ms
59ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

4a34cf7a580b600dbbba734ec62fcb28f479657a859944722e1b1e99ff42e4da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 9326
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:42 GMT
expires: Sun, 10 Jul 2022 20:17:42 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 clog
hblg.media.net/ Frame 9BBA 35 B
172 B 20ms
19ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/clog?logid=awlog&pixel_len_bucket=4719&lmt_enf=true&req_mtype%3C%3E=0&mx_nsz=1&spSource=0&ifst=0&vid=YsiQ5QAIXDcKh-eP0QiQyQ&s_city=charleston&ugd=4&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D2%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1%7Ctpi%3D1&app=0&ctr=0.0&mx_TAF=2&device_id=4&ae=false&mx_UCC=4&prspt=headerBid&mx_bss_algos%3C%3E=0&usp_status=0&seat=BID_API&og_cbdp=0.150&size=728x90&mx_TAS=1&mx_gpid_sent=false&xtmax=290&commit_id=6ac920ad&scrid=1700080812897200728009000001000&itypeid=17&mx_SPRIG=2&viewability=51&renderer=0&be=0&rtime=28.0&adj0=0.0&tmax=300&s_ip=74.125.78.132&adj2=0.0&adj1=0.0&adtypes=0&mx_aabpc=0&reqid=YsiQ5QAIXDcKh-eP0QiQyQ&sc=IL&sd=2&mowxReqId=00fd9a5a68c5437cb1f7f84b94aaa1f2_1&ifdp=0&requrl=https%3A%2F%2Fxmod.in%2Fblog&bidrestime=1657311461594&pv_adtype=0&cc=US&strg=HARMONY&cxtSgmt=segment_broad_technology_computing&pcrid=8CU5RJ1PV-764724967-28-22&coppa_enf=true&bdp=0.150&ct=Chicago&spIsReq=3&s=1&abs=0%7C0%7Cxtmax%3D290%7CHARMONY%7Cbrr%3D0&mx_epbc=8CU5RJ1PV&dnt_enf=false&mx_ssBucket=0&vls=0&asn=16276&mang=1&fleet=appnexus&mx_isLossNtf=false&advUrl=https%3A%2F%2Fsearch.yahoo.com&dn=xmod.in&pgcatiab2=628&dt=O&acid=00fd9a5a68c5437cb1f7f84b94aaa1f2&actltime=34&act=headerBid&iframingState=0&mx_lr_seg_deal=0&exclattr=32%7C34%7C70%7C13%7C14%7C15%7C48%7C16%7C17%7C18%7C114%7C19%7C20%7C22%7C25%7C26%7C27&dfpBd=0.102&sckfl=1&dmm_erpm=true&mx_lr=0&mview=1&smbrid=adx-unknown&bfs=103&rfc=-1&prvApiId=8CU5RJ1PV&epcexp=false&pubid=pub-ADX-116310109131&mx_bsProfile=0&cid=8CUU9JF8H&bcrid=1700080812897200728009000001000&omul=1.0&res_mtype=0&apPrfs%3C%3E=60%23%2315%23%2313%23%2310&suid=CAESEEDbbBwOYugU9XTgTDofEwM&chnl=HARMONY&pst=0&reqsize=728x90&adpos=1&itype=ADX&mx_g_one_uid_sent=None&spCst=0&tgtval=pub-ADX-116310109131&__expireat=1657312061847&lmt_status=N&reftype=3&viewability_vendor=EXCHANGE&prvAccId=764724967&ckfl=0&lper=1&mx_tgs=728x90&cbdp=0.102&pvdTmax=248&ltime=34.0&epc=764724967&ctr_vendor=EXCHANGE&prvReqId=39940985460180_999781551_11621109112941&zip=60641&exid=31&spFst=0&mx_GCID=0&cliIPType=v4&pexid=ADX-pub-8676560598296682&ybnca_erpm=0.15&brsrclk=0&sbdrid=196&rtttime=44&apTags%3C%3E=75&mx_PC=1&wsip=mowx-lite-7776598566-hvxcz&currsrc_date=2022-07-08+00%3A00%3A00&psrc=fail&geoll=false&debug_ts=2022-07-08+20%3A17%3A41&policy_enf=2&mx_ssProfile=0&mx_SC=0&reftime=60&pbidflr=0.010&spbf=0&currsrc=API&fpusp=false&lmt_applied=N&mnrfc=-1&pub_blk_enf=1&amptype=1&moau=true&ocurr=USD&snm=SUCCESS&mx_IAB2=1&usp_enf=1&bidflr=0.010&incentive_type=0&skadidfl=0&pid=8PR113JGC&spTo=3&pvid=294&schain_cmpl=0&is_ortb=false&mx_aurl_hc=0&ucrid_ver=2&mx_maq_call=false&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=1&dbf=1&gdpr=0&gqid=AADH9t8a2r1Q8VguoUHKO-dW4DvUXgzZTZPv1aLY-xYiwHzyqe42l0LqTf5UR8xu31IxfYKr&dmm_ogerpm=false&csip=rtb-appnexus-7cfb9985db-885jb.SC&mx_bsBucket=0&mx_aurt=0&spIvt=3&ptype=23&media=0&smsrc=1&acsn=1&dtc=east_sc&mx_aqcpl_crid=4&ogbdp=0.15&tpbTkn=false&adblk=740958930&fpuReq=1&vcmplrt=-1.0&crid=116211091&geo_source=2&sat=1&mnet_ckfl=0&mp_seg%3C%3E=44632%23%2360149%23%2344652%23%2344661%23%2344629%23%2361058%23%237688%23%2355664%23%2352765%23%2343988%23%237708%23%2317191%23%237717%23%237685&opbidflr=0.010&impId=1&rme=adm&bdata=sd2%3Dnull~iurl_l%3D20~ogerpm%3D0.15~vis_sd%3D199~url_rps_b%3D9.26~dom_b%3D1~dc2%3D1~scd%3Dqc~v_asn%3D16276~dom_l%3D20~vl2r_sd%3D2022070808~iurl_b%3D717.11~url_tkc%3D0~url_r2a_b%3D0~std%3D~MP%3D.*blog.*~last%3D~vis_url_b%3D0.35~ip%3D2Jqus0~fbb%3D0~vis_url_l%3D30~riipua%3D0%2C0~et%3D28~rc%3D3%2C177~risuid%3D0%2C0~rps_sd%3D2022070813~vis_b%3D312.43~url_b%3D2.48~vl2r_url_b%3D0~vl2r_url_vi%3D1E0~url_tvi%3D49~url_l%3D10~gcat%3D501022~bb%3D196~vv%3D0~cvl2r_sd%3D196~l2r_b%3D1000~erpm%3D0.15~vl2r_url_kc%3D0E0~vl2r_up_l%3D20~bm%3D1~sid%3D764724967~sd%3D2~uid%3Dh8gpe3f8kL5zUQvDY~url_rps_kc%3D0~cvl2r_b%3D1.97~btd%3D1174437382627052616754654661045638820839722883039221732366578192643943657115648~cvl2%3D1.93~3pcf%3D1001.71~uim%3D0~dmm_strg%3Dharmony~vl2r_up_b%3D0~ss%3DNA~uiw%3D-1~ce%3D0~rps_b%3D110.82~url_srps_b%3D19.09~CI%3D2702~nts%3D1~MP2%3D.*blog.*~tb%3D-1~ct%3Dmontreal~basis2%3D196~basis1%3D196~isRef%3D0~PF%3D0~isif%3D0~lc%3D1~url_rpc_b%3D0~bid%3D0.15~dc%3D8~url_rps_rv%3D0~vl2r_b%3D4.1~supply_tag_id%3D%7Eviewability%3D0.51%7Eamp%3D1%7Ecbdp%3D0.150%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D2%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3D%7Ehtml%3D1%7Eadblk%3D740958930%7Esobp%3D%7Ectr%3D0.0%7Ebdpcapd%3D0%7Edmm_erpm%3Dfalse%7Ebflr%3D0.010%7Eogbid%3D0.150%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D740958930%7Edetected_tag_id%3D%7Edcut%3D30%7Edogb%3D0-1~ibc%3D1~ddt%3D-1~nsz%3D1~tgs%3D728x90~bsb%3D0~bsp%3D0~tmx%3D248&utime=1183&sf=0&cpr=0.39428833784487605
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: max-age=3600
date: Fri, 08 Jul 2022 20:17:42 GMT
server: Apache
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=21600
content-length: 35
expires: Sat, 09 Jul 2022 02:17:42 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2042 31 KB
10 KB 21ms
20ms Script
text/html 23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4a411ecc4f2769a81a8f2fc5a796ae019bbaa0ca05aa70ef91d7029e6a3f54b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=50003
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9455
Expires: Sat, 09 Jul 2022 10:11:05 GMT

GET
DATA 200
OK truncated
/ Frame 8CF1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: feff093bf16526932a7a3245ecf5896d93a542d0609fc0647c2c193764437785

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5E65
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=bea062c8-90e4-4c00-bf77-b3eaa870d307

43 B
910 B

90ms
85ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=bea062c8-90e4-4c00-bf77-b3eaa870d307
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81439aeea23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aXkfLq%2F5LqyjUAmZf2xTHrvbVmBVmG189xj9C%2BLDS%2BTlQYtKx1Q8ceudFXDqI7%2BJiIrvb1FA0dTaoGnwfcPjSVJpQbr0MXTQzb0J1cvjsjrDQfHIRD2RgZtmjwH9%2BhnSXBLd6Cg1gVvsIA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x35 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=bea062c8-90e4-4c00-bf77-b3eaa870d307
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5E65
Redirect Chain

https://ad.turn.com/r/cs?pid=21
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8147514277513099876

43 B
904 B

72ms
68ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8147514277513099876
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81439aefa23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Nhj0SnKWYJVCdqCo0bXFGOzBf73fMI%2BeStMPcIRz%2F6eaRNa6Ln2yebBagGgzt10c5F22SDSYg0EVYIqfePSOo5sPpagwqCVijJoVBEAIzPmz5JcW9UrNidbiAYPP1NcbTNoYfqHSQsmPw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8147514277513099876
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

rum
dsum.casalemedia.com/ Frame 5E65
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=76a9392cf47a122a&is_secure=true&networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGdGP8gG5vrgNb6ys3AAAAAAA&expiration=1657397863&is_secure=true

43 B
899 B

61ms
60ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGdGP8gG5vrgNb6ys3AAAAAAA&expiration=1657397863&is_secure=true
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8145bc6ca228-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lT7arHwTitUpTTg7qDomTEQSfrdDtaSpCCeoyu7U9bXz0%2F6gUVpr%2F6CC0QzofKt7eDL8amrpbtMJkfzs%2FGmgqA2PRPNpcnwNUsJspnEAuCJ1zkiX3v%2FERVWf4KZo0P3UwPulDnZ%2F"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGdGP8gG5vrgNb6ys3AAAAAAA&expiration=1657397863&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

rum
r.casalemedia.com/ Frame 5E65
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=

43 B
943 B

129ms
55ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H2
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8144bbaca253-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OdqYZC%2FHz6jkh27xijPXFqGS6l%2FHPLrtJ7vT93h2nn7bbkVUKdX1RU%2F4N5gmYXbO2HDzUlAviK0yzfySwPbC0oMtBjSbNsBHqn%2BRo%2BDWrCgFSRbCTjObNAg8I7Q3A8rVqC3R"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 5E65 43 B
992 B 38ms
24ms Image
image/gif 2600:1f18:4e9:5a02:357b:502f:f800:1eb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:357b:502f:f800:1eb Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5E65
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YsiQ5AAO0ntNvgAo

43 B
910 B

49ms
48ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YsiQ5AAO0ntNvgAo
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81443be3a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hn6kkucqDDJiL64NaXxW%2FY7pjUFVgJBpimEaN%2Fk0hQluwxkuoWEr%2B%2Byeiu3bcgy0kbaDOzvDRJ1XVCRk2RqlXQf59J5gX6pizZEZIsHkJtrEy5uSeNTedNdnUZwsB9nJZ2DTj9UjL%2Fsq0w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1657311463.966094,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YsiQ5AAO0ntNvgAo
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5E65
Redirect Chain

https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-8725e476-3237-420a-89b3-722d1ff4f1bc

43 B
905 B

118ms
106ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-8725e476-3237-420a-89b3-722d1ff4f1bc
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8144fcb8a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jra%2BF5cKvP6e7PSCpckxe6240CkqpR7ClOmhCBFaQRAb8MmHLmBTyWuCvUMpsnWj%2FBNYEVxrUCHumjXzluzblRD4nIXDlJPlOUC21yocTqorlTiY5t4koqx58XIHVVxycTXU1uGJRs44yA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-8725e476-3237-420a-89b3-722d1ff4f1bc
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Apache-Coyote/1.1
content-length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5E65
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1783777314005288881

43 B
911 B

69ms
57ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1783777314005288881
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81444c01a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GlBkl9%2BRjOpdC9D2AUb%2B3KtLUqUY2LYi%2FdWG2Z4UH2M7aAw3yvK2aEcJJQ33TPOid%2Bqa3ycMnXZDW2KflEgMQDJBvH2guNt3MJIGZpfD9zpcl3MR74djQGRBT%2FdWTCUqyHKGRogBtpYYdA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1783777314005288881
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 um
u-iad04.e-planning.net/ Frame 5E65 42 B
103 B 36ms
22ms Image
image/gif 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=99e41df815fd80b4&fi=43c40cadbd39e3cd&uid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: openresty
content-type: image/gif

GET
DATA 200
OK truncated
/ Frame 4A94 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4A94 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK OpenSans_Bold.woff
res-a.akamaihd.net/__media__/fonts/OpenSans_Bold/ Frame 4A94 25 KB
25 KB 325ms
260ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/OpenSans_Bold/OpenSans_Bold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T586N56&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311461246412568&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=B4zx%2F8fOnRrolnfOur8Bge4B&bdrId=294&ntv=0&matchstring=hr%3D1%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058298&kapc=16&ekals=775EJvu99ui%7C%7CENvuF%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1973bb0e810b8f54792d7ea56c03749f6792541876847b085f58d64fb7adfc07

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-6478"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25720

GET
H/1.1 200
OK Roboto-Bold.woff
res-a.akamaihd.net/__media__/fonts/Roboto-Bold/ Frame 4A94 24 KB
25 KB 83ms
19ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Roboto-Bold/Roboto-Bold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T586N56&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311461246412568&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=B4zx%2F8fOnRrolnfOur8Bge4B&bdrId=294&ntv=0&matchstring=hr%3D1%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058298&kapc=16&ekals=775EJvu99ui%7C%7CENvuF%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c8a7ea184c79a6f61c400968314d03aae7c327f03efc03603f6a3cbada7bfb9a

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-60f0"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24816

GET
H/1.1 200
OK roboto-medium.woff
res-a.akamaihd.net/__media__/fonts/roboto-medium/ Frame 4A94 25 KB
25 KB 83ms
19ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/roboto-medium/roboto-medium.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T586N56&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311461246412568&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=B4zx%2F8fOnRrolnfOur8Bge4B&bdrId=294&ntv=0&matchstring=hr%3D1%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058298&kapc=16&ekals=775EJvu99ui%7C%7CENvuF%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 6b6488e5bc3f897bb0516f0c2e68290e1a68822795271a7ff8bba380f9c89128

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-6208"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25096

GET
H/1.1 200
OK Roboto-Regular.woff
res-a.akamaihd.net/__media__/fonts/Roboto-Regular/ Frame 4A94 24 KB
25 KB 104ms
19ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Roboto-Regular/Roboto-Regular.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T586N56&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311461246412568&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=B4zx%2F8fOnRrolnfOur8Bge4B&bdrId=294&ntv=0&matchstring=hr%3D1%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058298&kapc=16&ekals=775EJvu99ui%7C%7CENvuF%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a1e5b0dd9cd90fe3ef3e24aea202819ee74693d62c00bac8e3fb7c837d8adbfe

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-61bc"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25020

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E072 31 KB
10 KB 20ms
20ms Script
text/html 23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4a411ecc4f2769a81a8f2fc5a796ae019bbaa0ca05aa70ef91d7029e6a3f54b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=50003
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9455
Expires: Sat, 09 Jul 2022 10:11:05 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 063F 0
260 B 527ms
20ms Script
text/plain 104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=137711&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 39F0 412 B
285 B 37ms
37ms Document
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNWugL7Dw8cDiy3mWF0Z4KEMnBrLoZHeGmWmhcuQtkMZt58HIhl925yGe_bYBSpSe5WVvGOSHiTXaXhdDj9IuOXwR9cS2B_xamLLBj1nvmrrOnCkdmg

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5caab4f619e85958d7b9985c51504f31aa65076fba3ecf921eb3f91fe5061e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 264
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 176838570921095027
s0.2mdn.net/simgad/ Frame E63E 63 KB
63 KB 20ms
20ms Image
image/png 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/176838570921095027

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c99bee74aefc77081cf112204158705bbaf711b1cd30d5942ba97ba77da8182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sat, 02 Jul 2022 04:31:51 GMT
x-content-type-options: nosniff
age: 575151
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64740
x-xss-protection: 0
last-modified: Thu, 02 Jun 2022 19:10:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jul 2023 04:31:51 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/ Frame E63E 21 KB
8 KB 20ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/abg_lite_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2625083f682f667dbd0121720f86b02cc023e7cc2c36d1fad2d1a3dbe0b8cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 19:16:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8671
x-xss-protection: 0
server: cafe
etag: 18116328616323621410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 19:16:38 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/ Frame E63E 6 KB
3 KB 21ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220706/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b175e3d672f1560352dc7df0b4e1aaf4cf6dba4605563465df69fcceb052bbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 12:32:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27898
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2628
x-xss-protection: 0
server: cafe
etag: 1103433747108554897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 12:32:44 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E63E 0
27 B 46ms
46ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssW7ekrfu869cjov6gh1PgiChZEV-WxBi6w7qjA9zSL0hcvCX6dDh_cze65JNAaIWjeU_zF61FlrQOKllx2PO3wDUvSSjJmaFJrQZ8S8gih1OpqCmHNl462Wso0du2us1qatAnfsTNp0dUPyBO_1nLpOcvgK_e33bpKb6FbAqStq0oryNz4AAxbgzB7DvMrmYVt9jh3UzgnUSP3eNasHkzF1VosaeJn4CkLUWL55pDGJO0uOQf_7IXcl3uHlT0H6miHSGCBnifFwVkf77jDssji2GFExxCmwYwc7WEoqEfjD9LevCQN8qqwrsDNiGqXvbY_r118pCko_U33x8Z1OlDfKuEC2IKTMHwPMWHoziA9TENUA9vbVPVm58-ywYYgw1qC9TSQiA6W0Lqy-a_aQFvwDU4aU2uNJPyNs2STd_Qsv3LfmgixoPs-6Wazbnhi2TNwIixrjDxy5EL4rzTfvAWtytX-4UEd2LhG-aPeB4kjC6Iq3TLs1Uz-KpPTHrwmpa5R3xZ2dpzvzY697b5OuYchd4urdPus8YYOUEfp_jpUPKVtnbRl0aXjCF16IlwyekJCf6rx58Cfc9GctETq9GYPhdEVSoeDknW1ustbIgIfk2uY0HZrAm49ZeejBXj_tHc5QMlSDCxiUualcl-kM4bSRxDIdEXV1PBBBviM0ZYXHyZBtgvLsNARH9rY6Xak-aBd5ilpMgXMqgaHSQBNpZSfjL24cm7x0m55HZQ4yTqlii8fXNKlqRheJgaPp_0cPKQ2xiqPxJPBHOaOesEWxfFWt4WdkIDupqhKFvnIZ7kk49uW_GEJiahCc-TxBjsTGZxddT7rxmKkizMmzGNtR3ImO68DP4fLvB6Csb35WrD5-fwJJSv44LHcZm2T_n-QUCJ-bOOJOLjELI_buAdkl_tmF4qWyax0fJRrfcd4gNahkIDTddQZU52vESvl0WS10LYYCRSqUvwLNq9541vnWTq0qcmR8OivzDm7oqcXq-5qq_cvDBcgBIoUwjpLms1WGYGgqn0Q9U5V2rp4mF5ghDQApBvySCn5b-Z0dzwNlWLL57DGov-OCo5Ci43DXrDN17hLcVnIS-cwxLsVhbMBSijKw7N4DHHn8j-8FKCniFmLdK9HxXMH1y-qNC8FsJGET66k--XLXhufjOPyBZ6M_wvu9IvobsHgVWLUwCxCY_uZNOrnu_tIm_4&sai=AMfl-YT1tejOOAjM2gII0iomWTDsLnotCHjio8scgUYPSjmu7AO-vobIGLzkZ_Q8T1KT-D60RCAuU25O-bLGIwII7HOw1e_c2lMRB1FIs-vC4TPgLLZPh4fBFqIhsCZi3mD3crg1Ya0NLuMl49YrT_UmwNxOYaNjmQAGvq2SF7fUtT-wKU8FO-145FV4AkLb1H1OSaUwAq-DgTXqswQ_kNAMHbznu7ts91s_b2c-QtLyNB9WHlWwM4yLm3WlssZ-8NbKA4u2k0xzQMdJ8XSlTD5H-1w8SsPYLv6RV6q30GXsDqUc&sig=Cg0ArKJSzMnr9PhhTz_8EAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220706.91123&adurl=

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 08 Jul 2022 20:17:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E63E 41 KB
15 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 18:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92760
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Jul 2023 18:31:42 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E63E 42 B
65 B 47ms
46ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D6mui4I0AYzLSJzXP17ADBTtQ4C9UIA8l-UKiKjrCBUtn9xpdngIkk6skcZmDf7LOVJR9Nii3hQx8rTvCMJh7iykQpcximud4tVDUjBr2e2G27CL4

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame E63E 3 KB
1 KB 25ms
19ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 763
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E63E 137 KB
42 KB 52ms
46ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame E63E 17 KB
7 KB 27ms
22ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E63E 0
0 42ms
38ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSscFckO5H1Qa-pk1oH_9mY32iAsk57T-ZPq_TLjkG_z3HUpjzN_WMBE2Aylm0OYpHFHhL2QLHMf2tBSoK_eMOrS8Khsw
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 5D21 2 KB
3 KB 20ms
19ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=9365315&p=158810&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: d20b00400881d80f6639bd42f27bf69c50c81c1ec1058d8c45f53753d0457c66

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E9F5 6 KB
3 KB 24ms
18ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame AD16 22 KB
8 KB 25ms
20ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 92722
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Jul 2022 18:32:20 GMT
expires: Fri, 07 Jul 2023 18:32:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 502C 1 KB
753 B 20ms
19ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3336
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9BBA 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3caa06085438ac7a81be1ad6fabd9db352e4b5950ba329627eeddab39033bc8f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 481A
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESECixtGrEMKmDH3Mhlk8kzvk&google_cver=1&google_push=ARnp8GBrsk9wBdg4eaqXpHnCuKy9giFBYoy7OxLgsNqhXSixJ5gV8D_4no0U_WgD8UGGW3TPuidEc4HdvtxWnOF5...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=vqBiyJDkTAC_d7PqqHDTBw&google_push=ARnp8GBrsk9wBdg4eaqXpHnCuKy9giFBYoy7OxLgsNqhXSixJ5gV8D_4no0U_WgD8UGGW3TPuidEc4HdvtxWnOF5d9ORNAY3MeA

170 B
188 B

60ms
46ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=vqBiyJDkTAC_d7PqqHDTBw&google_push=ARnp8GBrsk9wBdg4eaqXpHnCuKy9giFBYoy7OxLgsNqhXSixJ5gV8D_4no0U_WgD8UGGW3TPuidEc4HdvtxWnOF5d9ORNAY3MeA

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x34 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=vqBiyJDkTAC_d7PqqHDTBw&google_push=ARnp8GBrsk9wBdg4eaqXpHnCuKy9giFBYoy7OxLgsNqhXSixJ5gV8D_4no0U_WgD8UGGW3TPuidEc4HdvtxWnOF5d9ORNAY3MeA
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:41 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 481A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIp_QCg_YMr4XpZIsyHVXAQ&google_cver=1&google_push=ARnp8GBFUyoNlEw4DePhJX14MtpvItIf0eyPNwj0uscG4LW63J7he_q4LyBf7x8ps1ah4OqmLAUVwycqdMWMhYS3aadAPO_...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ARnp8GBFUyoNlEw4DePhJX14MtpvItIf0eyPNwj0uscG4LW63J7he_q4LyBf7x8ps1ah4OqmLAUVwycqdMWMhYS3aadAPO_ynN8&google_hm=MzQ3NjM0OTUxOTQ1OTM4MDE...

170 B
188 B

61ms
47ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ARnp8GBFUyoNlEw4DePhJX14MtpvItIf0eyPNwj0uscG4LW63J7he_q4LyBf7x8ps1ah4OqmLAUVwycqdMWMhYS3aadAPO_ynN8&google_hm=MzQ3NjM0OTUxOTQ1OTM4MDExMQ%3D%3D

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ARnp8GBFUyoNlEw4DePhJX14MtpvItIf0eyPNwj0uscG4LW63J7he_q4LyBf7x8ps1ah4OqmLAUVwycqdMWMhYS3aadAPO_ynN8&google_hm=MzQ3NjM0OTUxOTQ1OTM4MDExMQ%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 481A
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFoxG3bO-MtPoaiI4xMNc_8&google_cver=1&google_push=ARnp8GA4G78ZOXmvT7M5oyIpJvH25YyyD3XmCp0b5i9jtxIrk6DAaIAznlj_kXf3gItxHw8Z8fyFt2q0QmPd_7ezWNKS65fTAQg
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ARnp8GA4G78ZOXmvT7M5oyIpJvH25YyyD3XmCp0b5i9jtxIrk6DAaIAznlj_kXf3gItxHw8Z8fyFt2q0QmPd_7ezWNKS65fTAQg&google_hm=ZfI0mm55jKunv71j6Qw5ig==

170 B
188 B

51ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ARnp8GA4G78ZOXmvT7M5oyIpJvH25YyyD3XmCp0b5i9jtxIrk6DAaIAznlj_kXf3gItxHw8Z8fyFt2q0QmPd_7ezWNKS65fTAQg&google_hm=ZfI0mm55jKunv71j6Qw5ig==

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ARnp8GA4G78ZOXmvT7M5oyIpJvH25YyyD3XmCp0b5i9jtxIrk6DAaIAznlj_kXf3gItxHw8Z8fyFt2q0QmPd_7ezWNKS65fTAQg&google_hm=ZfI0mm55jKunv71j6Qw5ig==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: 1f85jn097mjdalg8ast6c4dh53o7psqd

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 481A
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEM6EcucQAI6Ehc7sh4Wg0ZE&google_cver=1&google_push=ARnp8GBfIu2Ba_z9Ep9Mdfd_zroh1nTeRR2aLmmPcFb2T9VxHZllsY0z_0fZVaONL-F-boRBBNj_TwT-3ygNqaGR7NioQQ...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=ZeZ_WugnTzW8fP9jeWLxHw&google_push=ARnp8GBfIu2Ba_z9Ep9Mdfd_zroh1nTeRR2aLmmPcFb2T9VxHZllsY0z_0fZVaONL-F-boRBBNj_TwT-3ygNqaG...

170 B
188 B

58ms
47ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=ZeZ_WugnTzW8fP9jeWLxHw&google_push=ARnp8GBfIu2Ba_z9Ep9Mdfd_zroh1nTeRR2aLmmPcFb2T9VxHZllsY0z_0fZVaONL-F-boRBBNj_TwT-3ygNqaGR7NioQQvmAxQ

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=ZeZ_WugnTzW8fP9jeWLxHw&google_push=ARnp8GBfIu2Ba_z9Ep9Mdfd_zroh1nTeRR2aLmmPcFb2T9VxHZllsY0z_0fZVaONL-F-boRBBNj_TwT-3ygNqaGR7NioQQvmAxQ
date: Fri, 08 Jul 2022 20:17:42 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 204 pub
cs.chocolateplatform.com/ Frame 481A 0
68 B 161ms
20ms Image
text/plain 159.203.145.121
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESENNCzCTvTvOS2HThlRT2wKA&google_cver=1&google_push=ARnp8GBh5TE3rYkxxccKWRwnT6pNUEDfhJ376LoQxseoDrowRqbHQDBmGitD9wE8saE4NSBfy_xPhSap2idtxaFTEwJA1yLjEDw
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.203.145.121 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Chocolate Cookie Sync Powered by Vdopia /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: Chocolate Cookie Sync Powered by Vdopia

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 481A
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEH7XH_NvafWPOChDoAjA1nU&google_cver=1&google_push=ARnp8GC2iPcCnERy9Y5mBaTPpzXMd3XjMEmTJoBrguPQnGZNstA66Jay4oih_7-u0aM0u7DGnFJUbd...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GC2iPcCnERy9Y5mBaTPpzXMd3XjMEmTJoBrguPQnGZNstA66Jay4oih_7-u0aM0u7DGnFJUbdgr_GuvEGDtP0Lt4cM-tQM&google_hm=ODkwMTQ4NDQ...

170 B
188 B

87ms
76ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GC2iPcCnERy9Y5mBaTPpzXMd3XjMEmTJoBrguPQnGZNstA66Jay4oih_7-u0aM0u7DGnFJUbdgr_GuvEGDtP0Lt4cM-tQM&google_hm=ODkwMTQ4NDQ4MDUzOTUzMzY4OQ%3D%3D

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GC2iPcCnERy9Y5mBaTPpzXMd3XjMEmTJoBrguPQnGZNstA66Jay4oih_7-u0aM0u7DGnFJUbdgr_GuvEGDtP0Lt4cM-tQM&google_hm=ODkwMTQ4NDQ4MDUzOTUzMzY4OQ%3D%3D
date: Fri, 08 Jul 2022 20:17:42 GMT
content-length: 0

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 481A 43 B
65 B 51ms
39ms Image
image/gif 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEG1z8NM4vk5KEffsPkuEous&google_cver=1&google_push=ARnp8GC7lEOuC-SuV4N-7N5_pDhzgqO7V0jY5UxkEQ19OLWV3D5pwVV6_cdT63uCsFEZFTkdL46FDHdR41GmB41jINUVSNvIwu2g

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Jul 2022 20:17:42 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 481A 0
12 B 69ms
57ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I9jJRtbOaIA2LL_EkXt692XfMlDhcKU02pQUJPY5IzXZQ3WZqZn5T15ejThuqRk_Fp0gNJ4w

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEIM-cBlqxrJXC9pgO-de4wE&google_cver=1&google_push=ARnp8GD06Z0jQDLFKF9-va82cfL8DDiQbsxzheetjKb_dKIphaNEKI0XtEXPD10WWNAokKiGR2VPw...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ARnp8GD06Z0jQDLFKF9-va82cfL8DDiQbsxzheetjKb_dKIphaNEKI0XtEXPD10WWNAokKiGR2VPwpQGkLLclVGbjIZE_b9VAfma

170 B
188 B

49ms
40ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ARnp8GD06Z0jQDLFKF9-va82cfL8DDiQbsxzheetjKb_dKIphaNEKI0XtEXPD10WWNAokKiGR2VPwpQGkLLclVGbjIZE_b9VAfma

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:42 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 0D2163D257464359AAB362EF29E8BAA6 Ref B: YTO01EDGE0406 Ref C: 2022-07-08T20:17:43Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lva1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ARnp8GD06Z0jQDLFKF9-va82cfL8DDiQbsxzheetjKb_dKIphaNEKI0XtEXPD10WWNAokKiGR2VPwpQGkLLclVGbjIZE_b9VAfma
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAXjUOUJiPulbwVgTth8Tw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NzlmOTRhY2QtZjBmYy00Mzc1LTgyZWUtMjU2NzM2MDc3MjBi&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=1&google_push=ARnp8GCD...

170 B
188 B

49ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NzlmOTRhY2QtZjBmYy00Mzc1LTgyZWUtMjU2NzM2MDc3MjBi&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=1&google_push=ARnp8GCDn161yhvZ673chVGaq5afiYLIcxiWZHGOiCQAkOblTHWBOvBTWYtHnwDo5Qmg5bH-RKYPXVfwLduLaVk3h3w6m03jUH2J

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NzlmOTRhY2QtZjBmYy00Mzc1LTgyZWUtMjU2NzM2MDc3MjBi&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=1&google_push=ARnp8GCDn161yhvZ673chVGaq5afiYLIcxiWZHGOiCQAkOblTHWBOvBTWYtHnwDo5Qmg5bH-RKYPXVfwLduLaVk3h3w6m03jUH2J
date: Fri, 08 Jul 2022 20:17:43 GMT
content-length: 0
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIp_QCg_YMr4XpZIsyHVXAQ&google_cver=1&google_push=ARnp8GCbVU0u0t0u02ArOe5b6YXvg0rlMVp8uMqOozHXV4kDt2g8VyoTONGU9yNpqSfaTcE-ehiA78kvLHqZzKwaUQxj1qD...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ARnp8GCbVU0u0t0u02ArOe5b6YXvg0rlMVp8uMqOozHXV4kDt2g8VyoTONGU9yNpqSfaTcE-ehiA78kvLHqZzKwaUQxj1qDpxnST&google_hm=MzQ3NjM0OTUxOTQ1OTM4MD...

170 B
188 B

82ms
73ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ARnp8GCbVU0u0t0u02ArOe5b6YXvg0rlMVp8uMqOozHXV4kDt2g8VyoTONGU9yNpqSfaTcE-ehiA78kvLHqZzKwaUQxj1qDpxnST&google_hm=MzQ3NjM0OTUxOTQ1OTM4MDExMQ%3D%3D

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:42 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ARnp8GCbVU0u0t0u02ArOe5b6YXvg0rlMVp8uMqOozHXV4kDt2g8VyoTONGU9yNpqSfaTcE-ehiA78kvLHqZzKwaUQxj1qDpxnST&google_hm=MzQ3NjM0OTUxOTQ1OTM4MDExMQ%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESENTZ7NK44Oq058aBIcuH-Ho&google_cver=1&google_push=ARnp8GAcXt5t2n2CJu357WhjO8OBSKGLoOhIka8KJW9aA-9ZoHQAstAlPGlUm0azkz6z0p7CvR4625y8BMlW9...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ARnp8GAcXt5t2n2CJu357WhjO8OBSKGLoOhIka8KJW9aA-9ZoHQAstAlPGlUm0azkz6z0p7CvR4625y8BMlW94QLz98pAfTHAwX-&google_hm=amZ5Z0NaQXNYM19VUmJD...

170 B
188 B

48ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ARnp8GAcXt5t2n2CJu357WhjO8OBSKGLoOhIka8KJW9aA-9ZoHQAstAlPGlUm0azkz6z0p7CvR4625y8BMlW94QLz98pAfTHAwX-&google_hm=amZ5Z0NaQXNYM19VUmJDVHlGVEI=

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
P3p: CP="We do not support P3P header."
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ARnp8GAcXt5t2n2CJu357WhjO8OBSKGLoOhIka8KJW9aA-9ZoHQAstAlPGlUm0azkz6z0p7CvR4625y8BMlW94QLz98pAfTHAwX-&google_hm=amZ5Z0NaQXNYM19VUmJDVHlGVEI=
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEApWwpTttZUGTTLsMSVCPbA&google_cver=1&google_push=ARnp8GC-mV1I3-ahiqreKgiLi38gkXLWNm4DLo_OqOUpsF0Wt5QdxO3W3P8n3i1V1lSDY-wrb9KAOp6B...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEApWwpTttZUGTTLsMSVCPbA%26google_cver%3D1%26google_push%3DARnp8GC-mV1I3-ahiqreKg...
https://rtb2-useast.e-volution.ai/sync?adkuid=A1810852110846290499&exchange=193&google_gid=CAESEApWwpTttZUGTTLsMSVCPbA&google_cver=1&google_push=ARnp8GC-mV1I3-ahiqreKgiLi38gkXLWNm4DLo_OqOUpsF0Wt5Qd...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GC-mV1I3-ahiqreKgiLi38gkXLWNm4DLo_OqOUpsF0Wt5QdxO3W3P8n3i1V1lSDY-wrb9KAOp6...

170 B
188 B

57ms
56ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GC-mV1I3-ahiqreKgiLi38gkXLWNm4DLo_OqOUpsF0Wt5QdxO3W3P8n3i1V1lSDY-wrb9KAOp6BO3SFFXh85StKWWWQG7_yDA

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GC-mV1I3-ahiqreKgiLi38gkXLWNm4DLo_OqOUpsF0Wt5QdxO3W3P8n3i1V1lSDY-wrb9KAOp6BO3SFFXh85StKWWWQG7_yDA
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEBetOMzpTNYJoFvpoO_vzic&google_cver=1&google_push=ARnp8GD84IqbWvK3iPwz_f3Ru1put_EkLo8nCjkTdyFSVBDM8f3avmHcULa0sXTL2RDxd77YwPR4bvR39_tS0AXKf...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZDUwMjJkZGUtZTlmMi00MGNiLWI1ZTUtNDhhYmY0MjMxMmVl&google_push=ARnp8GD84IqbWvK3iPwz_f3Ru1put_EkLo8nCjkTdyFSVBDM8f3avmHcULa0sXTL...

170 B
188 B

62ms
48ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZDUwMjJkZGUtZTlmMi00MGNiLWI1ZTUtNDhhYmY0MjMxMmVl&google_push=ARnp8GD84IqbWvK3iPwz_f3Ru1put_EkLo8nCjkTdyFSVBDM8f3avmHcULa0sXTL2RDxd77YwPR4bvR39_tS0AXKfV5_P5LBxgNIbA

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZDUwMjJkZGUtZTlmMi00MGNiLWI1ZTUtNDhhYmY0MjMxMmVl&google_push=ARnp8GD84IqbWvK3iPwz_f3Ru1put_EkLo8nCjkTdyFSVBDM8f3avmHcULa0sXTL2RDxd77YwPR4bvR39_tS0AXKfV5_P5LBxgNIbA
date: Fri, 08 Jul 2022 20:17:42 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4DBB
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESECrM_AZwpIY1lT6tWNDqdiQ&google_cver=1&google_push=ARnp8GC2x_YGdmdwXp6jMMG0r-h86tXAEmUDviH6gocvw_-gIH57ik3kLdK7mqQKiwqZgWwhCCUbUxPEuFpKPsEPNSaYNCD3wvYWnQ
https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DARnp8GC2x_YGdmdwXp6jMMG0r-h86tXAEmUDviH6gocvw_-gIH57ik3kLdK7mqQKiwqZ...
https://sync.inmobi.com/gobRedirectFromId5?id=ID5-ZHMOXLmi6UdBjBFGgycEGLlWIKUuN-twQzpwiakINA&google_push=ARnp8GC2x_YGdmdwXp6jMMG0r-h86tXAEmUDviH6gocvw_-gIH57ik3kLdK7mqQKiwqZgWwhCCUbUxPEuFpKPsEPNSaY...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_hm=WuVYJSPPOq6oa1_6Qsqo&google_push=ARnp8GC2x_YGdmdwXp6jMMG0r-h86tXAEmUDviH6gocvw_-gIH57ik3kLdK7mqQKiwqZgWwhCCUbUxPEuFpKPsEPNSaYNC...

170 B
188 B

42ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_hm=WuVYJSPPOq6oa1_6Qsqo&google_push=ARnp8GC2x_YGdmdwXp6jMMG0r-h86tXAEmUDviH6gocvw_-gIH57ik3kLdK7mqQKiwqZgWwhCCUbUxPEuFpKPsEPNSaYNCD3wvYWnQ

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
x-download-options: noopen
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_hm=WuVYJSPPOq6oa1_6Qsqo&google_push=ARnp8GC2x_YGdmdwXp6jMMG0r-h86tXAEmUDviH6gocvw_-gIH57ik3kLdK7mqQKiwqZgWwhCCUbUxPEuFpKPsEPNSaYNCD3wvYWnQ
x-xss-protection: 0
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
vary: Accept
content-length: 227
x-content-type-options: nosniff

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4DBB 0
12 B 61ms
53ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JpBbImW_GzncIFgmmpCe8L5ZVn9MBZcPZZ0g64jgsAHfUq6I_1s8HEdBECOAP4qlop4PyDzo7t

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 lt.min.js Show response
tags.crwdcntrl.net/lt/c/15238/ Frame A58E 47 KB
15 KB 20ms
20ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Requested by: Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 074691f1175a4040f292124afbff0c87cd24290b7b9672577f33b7c7de205384

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 08 Jul 2022 19:04:01 GMT
content-encoding: gzip
last-modified: Wed, 15 Jun 2022 17:05:13 GMT
server: AmazonS3
age: 4422
etag: W/"a31a707739fd82541fa40e577dbbfede"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
cache-control: max-age: 86400
x-amz-cf-pop: JFK50-P4
x-amz-cf-id: EPapf8MhC2-kTOmpNAnnMJr0brLu2Dq8F2Pmd3UczZtpaX6Y7Eriaw==

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame DCF8 0
0 58ms
58ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CR7Vv5pDIYsjvBa_PnwSknY3ABOySrZFg99rS06wMwI23ARABIABgyYb_h_Cj7BKCARdjYS1wdWItODY3NjU2MDU5ODI5NjY4MqABlfWb3wPIAQngAgCoAwGqBIACT9BN4HGTUrxpJNVe3oOB2jVzpw2GF2j6yncnJUmcdrHC-oDtGrzoOYV40_MzgND6atGkpM6tt3RxJFjzyuV4kQJ4nRsxbRzp7IpW9ZRwmrSPs6V3vMyoN6AWDMn9JVgCJcI3bzZ7sbQGQVGtNGGcWJSimn9wmQgEdqCUdGAyC86IKRPPShW5r3LbaKZRNTowfc_J-Q15vjasE9uLT3sFPmhQJQGZg92LKtCfzjicqZGzIa7DNx17iDKtnklcC5NGNrbq4x7MiE__YJTyELn30EuGXoZR4LPo4glgMElixvnoaAik3pgnXHIm5m108GLC-Q4_gyB5HO3ir8NC1rDgl-AEAYAG3OPr2ZWgibcFoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgECACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItODY3NjU2MDU5ODI5NjY4MhiC3yI&sigh=x5fyeQr55pw&uach_m=[UACH]&cid=CAQSPACNIrLMi2sKC4fCcQ26-y2l7vSBrfIaGAgWFRQ8GMifhXgEPtS2E7Xr4eYEW8eQoTvlWi1j_O9hRVtUYRgB
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 log
hblg.media.net/ Frame DCF8 35 B
0 24ms
23ms Fetch
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hblg.media.net/log?logid=kfk&evtid=l1log&app=0&cc=US&ctr=0.0016823688&viewability=78&device_id=4&cbdp=0.347&slotVisibility=1&dn=xmod.in&acid=801d847da7dc4377ada544c2e5214403&ugd=4&size=300x250&pvid=294&csip=rtb-appnexus-7cfb9985db-b5t6w.SC&ogbdp=0.51&sc_pvid=319&prvReqId=118135143865769_47895406_11621109112941&itype=ADX&requrl=https%3A%2F%2Fxmod.in%2Fblog&scrid=1700080800126500300025000001000&mang=1&bidrestime=1657311462222&cid=8CUU9JF8H&rme=nurl
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame DCF8 35 B
0 24ms
23ms Fetch
image/gif 23.219.92.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&ckfl=0&lper=&app_type=adx&bdr_typ=1&ss_d1=0&ogerpm=0.5100&ss_d2=0&stid=&other_prv=319%7C294&jar_err=&current_day=5.0&adtyp=0&req_id=YsiQ5gACcHwKh7MHKwvEgQ&bd_m3=0.0000&bidfp=0.0100&bd_m2=0.0000&pvag_id=&bd_m1=0.0000&ugd=4&dim10=false&predicted_wr=73.4784&exp=&second_bidder=319&search_res=32&floor_bucket=0.00&gpid_format=&seat=BID_API&size=300x250&url_l1=blog&f_seg=segment_broad_technology_computing&prdp=0.3468&ogcbdp=0.5100&dfpbd=0.3468&server=1&ogerpm_wd_bkt=0-1&model_version=202207081116_generic_adx_1-cid_0&viewability=0.7800&dmm_r=0.0000&cut=32&dmm_l=0.0000&as_cache=1&tcyerpm=&sc=IL&send_erpm=true&dmm_m9=0.0000&sd=1&hb_exp=&seg=arc_health_8%2CComputing%2Ccpa_auto_ins_pop_cat%2Ccpa_auto_ins_pop_cat_mixed%2Ccpa_wheels_ap%2CInternet%2Csegment_broad_technology_computing%2CSocial_Networking%2CTechnology_and_Computing&dmm_m4=1.0000&erpm_bucket=0.60&ugd_ver=&requrl=xmod.in%2Fblog%2F&bidrestime=1657311462222&cc=US&strg=harmony&ss=&current_hour=19&time_stamp=2022-07-08+20%3A17%3A42&model_key=generic_adx_1-cid_0&rvshhon=&mul_ratio=0.0000&bdp=0.5100&ct=Chicago&akey=&mnckfl=0&bdp_bucket=0.60&algo=&dc=east_sc&splid=&dim4=ogerpm_multiplier_used&dn=xmod.in&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F103.0.5060.53+Safari%2F537.36&buyer_id=&bdp_wider_bucket=1&acid=801d847da7dc4377ada544c2e5214403&infl=&o_ver=NT+10.0&br_ver=103.0.5060.53&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m5=0.0000&ver=8.12.0&totalTimeBucket=2&visibility=1&totalTime=2696780&dmm_m1=2022-07-08+20%3A17%3A42.225221673&e_rpm=0.0000&dmm_m22=0.5100&gdpr=&vsid=&log_less=false&gpid_sent=false&ogerpm_used=false&bdmm_m12=0.0000&cid=8CUU9JF8H&bcrid=1700080800126500300025000001000&rawbid=0.5100&seat_id=BID_API&sub_bidder=186&pst=EMS&pbshr=100.0000&dmm_d10=&o_id=101&clisp=rtb-appnexus-7cfb9985db-b5t6w.SC&dfp_bucket=0.3&adblk=527204189&itype=adx&pvid_seat=294_BID_API&cliIP=2503514368&advurl=search.yahoo.com%2F&level_base=0&crid=116211091&sat=1&br_id=265&cut_bkt=30&gpid=&iwb=1&second_bid=0.020000&sc_pvid=294&capd=0&other_bids=0.02%7C0.51
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.219.92.153 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-219-92-153.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame DCF8 159 KB
55 KB 51ms
47ms Script
text/javascript 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

f14c028cc1465726aab171aea5ca59c39fa074891356e8fb9c99d6b0764cb748

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-mnt-h: 21-6005
content-encoding: gzip
etag: "5b6386cd34f16b09783f941fc0e33c38"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Fri, 08 Jul 2022 20:17:43 GMT
x-cache-hits: 0
strict-transport-security: max-age=31536000
x-mnt-w: 8-8
expires: Fri, 08 Jul 2022 20:22:43 GMT

GET
H2 200 adperformance.js Show response
warp.media.net/rtb/resource/ Frame DCF8 61 KB
62 KB 31ms
27ms Script
application/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resource/adperformance.js?v=35e90bcdc8

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

3378135f525fc551ce49d2c117e9967735794757a4c71910d8c1b8fa38bf3f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=604800
server: nginx
date: Fri, 08 Jul 2022 20:17:42 GMT
content-type: application/javascript;charset=ISO-8859-1
cache-control: max-age=53697
access-control-allow-credentials: true
content-length: 62892
expires: Sat, 09 Jul 2022 11:12:39 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame DCF8 3 KB
1 KB 43ms
41ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 763
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DCF8 137 KB
42 KB 48ms
45ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame DCF8 17 KB
7 KB 43ms
41ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DCF8 0
0 49ms
47ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaStWmyMCsab1a5hrlu14LfPousgy-SqJaZYpJrs3eJRH_g3x0p8RF2iI9qbD0OGiNoLrIFz6rlaG-NtJNuO-lTzSXkEHA
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame DCF8 22 KB
7 KB 44ms
42ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 06:34:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222172
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 06 Jul 2023 06:34:50 GMT

GET
H2 200 sirdata_03022021.html Show response
s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/ Frame B02B 636 B
577 B 79ms
40ms Document
text/html 172.98.26.121
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.121 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=157680000
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 20:17:42 GMT
etag: W/"601b131c-27c"
expires: Wed, 07 Jul 2027 20:17:42 GMT
last-modified: Wed, 03 Feb 2021 21:18:20 GMT
server: openresty

GET
H2 200 e-planning Show response
sync.quantumdex.io/usersync/ Frame 9548 957 B
658 B 83ms
45ms Document
text/html 2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/usersync/e-planning
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34bb92b7d18804c1e11b4543deae6020db67e4fde4a636682127912c19b1556f

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 727b8143fb81ca47-YUL
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare

GET
H/1.1 200
OK csync Show response
sync.adtelligent.com/ Frame 3062 0
387 B 46ms
18ms Document
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=307971&extuid=APHjDxDa7evIVhJZ
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:42 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 85ms
57ms Image
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022063001&jk=2642823349036530&bg=!hoWlhcHNAAaYcLjmuHA7ACkAdvg8WvOTvt-TcYnUp7DFJSjlgcvcDYUYzwlmX5tjnJrDpGn5mah6xgIAAAIiUgAAAAJoAQcKAL3JojPu8J1vHHqpoGVTfrBagjcwDdixaEXPm4yBZ0ywCNbD2UIZcuryuiuyq8315TdwItmU_EdtRIMr_u6yw4G90sFpWt65Xfat0vLmclY80Rf7j4_BSyhMQ-YoW7HbMT8XOm4cUjawDKe0J4qLmJXZWVGKckwmuDdGDlii5CnOgdNK3lTTZTIphxNsTZH1ly3ncYOugmVGKwWW6_Wm1FdlIrA8EBfgArC7wxGMjyr8EeHZf_0ckQh7T80ZWJCZApX-sgDBPP4T_2FLYLp9F3bln2UAY-VZ6tryGMykSmfJhcsShbWN2dNb_UZDVwqDU7NIkGhBsPtsbRNcpuOXzRifNdibxTmqD21xo2E0Bh4IGWY8774KTZyOb1TjM6Ki_7AmSfinCDfG4Amu76XFp87a09KtWEjkI-TFO7vzGleFMrz2_GQ9xNTHskRipO7keBEQLXCLgjfjLZjX-SDHHhwbAjuJYEIZtP1EzBkONCbiNXdp0JcDCV7JKB5lRlJSZAZUfVkhprr74GgCi2suBqEHepbHct_AhF1XZKMdNhyIDhR9u9FirkGvzQmCcjxtN-ZE8MTqpo0KkgC1lC4TwKfVGR_poYFsQPb3DFBKGj8a5tZxnYfmogwXbdRZYGFeBAR-DVD0BOSj3tMsSB99CeDOiGG2Wd2LDslUluQVyq1pjS3raa0DPF-nW87uljLVTCnHAx7yCk_H-ltx0GkZnO2tX-mI0kvw24GcTBdwyiZaLVRh2x6fJF6G_XjfcX4eS96--JxCPc6LWkQv_gLLLeVo_RgSQFZ1fKJ0GGVHO5ERwCvXOpN-etwz3lQMdVpIkPQ1xFD2fiNqqIpMrxX972xwgc6w9guhpmhlVpDFyo2Zf3aw3vQyEBWYzbm_NPZEvWogLTERiivF5He0XM7IEQ81kSmCTrJTP9tJb6575ve_UH-l3YTpfDrjU367VlDei-z11qKVUiHYoEh0fL0MnVPneYdOBdnXhtkUbfWWom4ZIPz1vPq8e609AnOE72GApjJukpqOsnQpOzQtMHUpiP0hH4P43xGurIySduIxiIqdMtXTBGe2g1M4BRY9guvEmTRtK3DpLKkdViNkC5rGn1wxWI0ZSP1eaxIG7tr2sO3OtkRq74QW
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 638F 31 KB
10 KB 46ms
20ms Script
text/html 23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4a411ecc4f2769a81a8f2fc5a796ae019bbaa0ca05aa70ef91d7029e6a3f54b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=17184-d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=50002
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9455
Expires: Sat, 09 Jul 2022 10:11:05 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3781
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEN60hhIkHVQv74R5wiMVFfI&google_cver=1&google_push=ARnp8GCWk9Y_-VF9-l2FKmFEcpXR0nq5nhFikXenE5V9TLcB-QscezCy4I...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ARnp8GCWk9Y_-VF9-l2FKmFEcpXR0nq5nhFikXenE5V9TLcB-QscezCy4IHIrsjzNff77x3nLKx_X4AJwmZVhoBdOVWG_jr1DBvS&google_hm=rYO9Ra...

170 B
188 B

45ms
44ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ARnp8GCWk9Y_-VF9-l2FKmFEcpXR0nq5nhFikXenE5V9TLcB-QscezCy4IHIrsjzNff77x3nLKx_X4AJwmZVhoBdOVWG_jr1DBvS&google_hm=rYO9Rac8dTPSt68JgfT36g

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ARnp8GCWk9Y_-VF9-l2FKmFEcpXR0nq5nhFikXenE5V9TLcB-QscezCy4IHIrsjzNff77x3nLKx_X4AJwmZVhoBdOVWG_jr1DBvS&google_hm=rYO9Rac8dTPSt68JgfT36g
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3781
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEC6ebXenuZR9P0OTJ2RIp88&google_cver=1&google_push=ARnp8GBBCWsonpTJGGYGTT-IF__GmILbwHiXmsXd_PJgpciX3vjQP-yC7JUISR0KP3qVDyJswx8Mf2Ce_1mumh92ZIcPweXxkIM
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=472EAFCEE13948B5AAD5A88A32E34BD1&google_push=ARnp8GBBCWsonpTJGGYGTT-IF__GmILbwHiXmsXd_PJgpciX3vjQP-yC7JUISR0KP3qVDyJswx8Mf2Ce_1mumh9...

170 B
188 B

49ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=472EAFCEE13948B5AAD5A88A32E34BD1&google_push=ARnp8GBBCWsonpTJGGYGTT-IF__GmILbwHiXmsXd_PJgpciX3vjQP-yC7JUISR0KP3qVDyJswx8Mf2Ce_1mumh92ZIcPweXxkIM

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=472EAFCEE13948B5AAD5A88A32E34BD1&google_push=ARnp8GBBCWsonpTJGGYGTT-IF__GmILbwHiXmsXd_PJgpciX3vjQP-yC7JUISR0KP3qVDyJswx8Mf2Ce_1mumh92ZIcPweXxkIM
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 07 Jul 2022 20:17:43 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3781
Redirect Chain

https://sync.extend.tv/r.gif?exchange=googleadx&google_gid=CAESEC-qQsV1ygQ5ET9gDJrt5PI&google_cver=1&google_push=ARnp8GCHTcvsoNKZujRfaBYNUGBMX-U_jFrQAgeVNpqWBdZMPPA9FUU8PVcwvsjhrYA-GX6e7F4v9lbo_CiD...
https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=ARnp8GCHTcvsoNKZujRfaBYNUGBMX-U_jFrQAgeVNpqWBdZMPPA9FUU8PVcwvsjhrYA-GX6e7F4v9lbo_CiDuvTaY56J6ccPrUw

170 B
188 B

38ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=ARnp8GCHTcvsoNKZujRfaBYNUGBMX-U_jFrQAgeVNpqWBdZMPPA9FUU8PVcwvsjhrYA-GX6e7F4v9lbo_CiDuvTaY56J6ccPrUw

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=ARnp8GCHTcvsoNKZujRfaBYNUGBMX-U_jFrQAgeVNpqWBdZMPPA9FUU8PVcwvsjhrYA-GX6e7F4v9lbo_CiDuvTaY56J6ccPrUw
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 193
Expires: Tue, 29 May 1984 15:00:00 GMT

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 3781 43 B
65 B 56ms
33ms Image
image/gif 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEDspq-blxmRC3rIdjWrQiIc&google_cver=1&google_push=ARnp8GClS8p53uUhFrOsed0Reaz4M5VnKkT6cvGLPidGgdXtarhddpm7zmuj3PfWVsdqksSTNrhDVaqimgai4JbIj4fnGCQcvxw

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Jul 2022 20:17:43 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3781
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENXocMcldTMxQT3EY-SMxUI&google_cver=1&google_push=ARnp8GBE6I_PSdWIuubXYcxFQ6QH6-jzfxJ3-HT8J_1Qaj_5Ndu4SWY0BKt3IzPGwtei13oGARwUesQ9...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GBE6I_PSdWIuubXYcxFQ6QH6-jzfxJ3-HT8J_1Qaj_5Ndu4SWY0BKt3IzPGwtei13oGARwUes...

170 B
188 B

57ms
40ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GBE6I_PSdWIuubXYcxFQ6QH6-jzfxJ3-HT8J_1Qaj_5Ndu4SWY0BKt3IzPGwtei13oGARwUesQ96HVcZgthHtNjhH2VGvmO

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GBE6I_PSdWIuubXYcxFQ6QH6-jzfxJ3-HT8J_1Qaj_5Ndu4SWY0BKt3IzPGwtei13oGARwUesQ96HVcZgthHtNjhH2VGvmO
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3781
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5hRwipa7RSyKksaM0QbLMQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

58ms
41ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5hRwipa7RSyKksaM0QbLMQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ARnp8GC6ix_keJyQ5fzQ0kLbe_eobnV6y-iXHV4VMFRI2aoM2VymEtPb5dXJcMNeZ0j7E-YS0Xrh43iS6zuVo12zNXBLpgqmf-g

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5hRwipa7RSyKksaM0QbLMQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ARnp8GC6ix_keJyQ5fzQ0kLbe_eobnV6y-iXHV4VMFRI2aoM2VymEtPb5dXJcMNeZ0j7E-YS0Xrh43iS6zuVo12zNXBLpgqmf-g
date: Fri, 08 Jul 2022 20:17:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3781
Redirect Chain

https://cs.emxdgt.com/um?ssp=google_ob&google_gid=CAESEKeW02esN9xUM-iJBnGm8ic&google_cver=1&google_push=ARnp8GDvArmG4pnRutMZRw2K0xc7aUpNuUl2-s-am5CR9BUouP-o_xu42_oGAs7cHGwaW4JAfs3ErMsMQOfFVr3HMb76N...
https://cm.g.doubleclick.net/pixel?google_nid=emx_eb&google_hm=NjQzNzE2NTczMTE0NjE0Njk3MjJhZg==

170 B
188 B

51ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=emx_eb&google_hm=NjQzNzE2NTczMTE0NjE0Njk3MjJhZg==

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=emx_eb&google_hm=NjQzNzE2NTczMTE0NjE0Njk3MjJhZg==
date: Fri, 08 Jul 2022 20:17:42 GMT
content-length: 0
content-type: text/html

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3781 0
12 B 54ms
35ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JWZsG0xcg5khFQQWyYIDw1FLixSP_xeJgY5B5-nswhvknxt8DYuDl8v491Ods8DTk9a4SR-w

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 AGSKWxUGlT71nH0LC8-1FGkuK3m9iilwmyq5qNOjBv8Xo0kqt2PFElVgdsD8hIXrgiOTQsXup3PQ1gZKVGaWJbAdjRJeSLc6gEALKtgHfEEJURNt411JrxNi1rP5qXkXYhUu2tyWIEHSxA_Ad7-yqIMz6iWDS5cC8mbXpTl-CDOBtoNlTq-gVKl7_-5LDaAt Show response
fundingchoicesmessages.google.com/el/ 0
28 B 60ms
53ms XHR
text/html 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUGlT71nH0LC8-1FGkuK3m9iilwmyq5qNOjBv8Xo0kqt2PFElVgdsD8hIXrgiOTQsXup3PQ1gZKVGaWJbAdjRJeSLc6gEALKtgHfEEJURNt411JrxNi1rP5qXkXYhUu2tyWIEHSxA_Ad7-yqIMz6iWDS5cC8mbXpTl-CDOBtoNlTq-gVKl7_-5LDaAt

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingCookieRefreshClientJs.en_US.N3ypOwyfgXk.es5.O/d=1/rs=AJlcJMya_VE2FO_zCAaf_sK6bMo2V0wzAA/m=cookie_refresh

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-o-CQOrCiBqqTsV58XkOGSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-o-CQOrCiBqqTsV58XkOGSg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://xmod.in
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-o-CQOrCiBqqTsV58XkOGSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-o-CQOrCiBqqTsV58XkOGSg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9CFC 0
25 B 69ms
57ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BV5qF5JDIYqGEFq6OjvQPytWjuAUAAAAAOAHgBAI&bg=!VFelVxPNAAaYcLjmuHA7ACkAdvg8Wlt7C9mfVCEzcYVjCvOzn1tEsEuqsEMd3IoboVXu5Ka8AJmnbgIAAASdUgAAAAJoAQeZAycLS-ofoEOX3_ZeyL5smOWM3kQJRGmM5WhknJ4USrw1zK6cwiy7THu0FBlEq1F8suifzNM3PKqiAAd3iHbAhZpW1mP39JBeEGZdHSQQGzMlz534890iR7Cnyqup-B1V77AJLPba3FiH51qyFkCiTgJa-Ue5YbMVl5AwOyGOe4bGNDDbPxdivqw1p5z6rX-Pr9hP39ByfRSj-d4KMyUGooOxH50PyM5bVi555RPe5eATFcDQLSBvDSjob5iyuPnAqYiHPGGloE3Irpju5DKX4kA_Fx0cf3nIB3ugE7ItmR1wHUPicSlsSqZUrITOhKJbU-_CDPvx4dgO8S3zxi1f6eb_4yUIUxOhj8V5sZhneWLZ4uyKmeftC-tRsiVvdvXKfd_kzNFn26UpSpkNNq-tTnCVeHxEmHFm_RALonyaAeOjta7XSi0H5aL0aS0F8_P9eOJN9DEPjB245tTONpqultE4-_glEjkut2IyvbC7vzo6U7BZKakssQcNJ2yoYaz_HYdfNE5VVNqaKu1fiiQHysW2dkJNErK0qz7zoXsgP0iJUjIxIUupO4bmQ1-Dgfk1fguqYTiQkY6PnHCHkLZSXvV63dvVr3NiX-y6zORZwSRz3SOB2ufBG4cHMUBijxCoie02ZrWJaFwRBJf00LFaObfu8HxX79WKKxzFsoAlTwYSKiCDvPHNaZOfuruCp7sDv2BEzFjr7Z3kT5QEiqQiJZCK8l8f2R-bRVN6qYQmoUgY4YtaBEUr2Vh8jF9uusjXEDwWNZA5l6Nd5_27dqJL_0F0pP4n01bccSqdLP3V8mj9J90SXeaXW_T2GUS9KEzKw5fog9Kf6GShDa9cOrva6VmtBe5Yf4iXa0dKIuLVteDi_PNF8E0i-1cKBgXnBmHoin3fHYRGvWzFGsoNd1COwGoSehdJ_psL6SolV5C6ayc81jlA7nfCeM9ecc8nc51UBld15yCQJSnVCZw9NgNj722k_nMk9m_HSC0KDyzKTUyyjUXbr0f1OBfnyLT6TVLLndBbaKyZowVH_YOEAzDI36_wsly5CRpiDKe7n_-rRDw_ZDq_JjU0Nck

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E63E 0
26 B 46ms
39ms Ping
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 39F0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm&gdpr=0
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMpTIxKN3lOiCJDWMUC-H9k&gdpr=0&google_cver=1

43 B
675 B

3259ms
1958ms

Image
image/gif

199.187.193.193
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMpTIxKN3lOiCJDWMUC-H9k&gdpr=0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP2FygEQ1NvFAhjNyYHMATAB&v=APEucNWugL7Dw8cDiy3mWF0Z4KEMnBrLoZHeGmWmhcuQtkMZt58HIhl925yGe_bYBSpSe5WVvGOSHiTXaXhdDj9IuOXwR9cS2B_xamLLBj1nvmrrOnCkdmg
Protocol: HTTP/1.1
Server: 199.187.193.193 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMpTIxKN3lOiCJDWMUC-H9k&gdpr=0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 327
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
rtb-csync.smartadserver.com/redir/ Frame 39F0 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 80AD 15 KB
6 KB 32ms
32ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D

Requested by

Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52836
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:43 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H3

204

1
sync-eu.connectad.io/pixel/ Frame F2C0
Redirect Chain

https://x.bidswitch.net/sync?ssp=rtaplus&user_id=Cfk16x8YFwfZ8ipxMIm8vrclYFJKs7HhWgAi27yU&gdpr=0
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=rtaplus&bsw_custom_parameter=254dd7d3-92b7-4826-982b-da30ccf966f8
https://x.bidswitch.net/sync?dsp_id=4&user_id=b4c4e194-2f45-4f77-a284-3282f71b50d9&ssp=rtaplus&expires=30&user_group=5&bsw_param=254dd7d3-92b7-4826-982b-da30ccf966f8
https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=254dd7d3-92b7-4826-982b-da30ccf966f8

0
0

135ms
113ms

Document
text/plain

2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=254dd7d3-92b7-4826-982b-da30ccf966f8
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status: DYNAMIC
cf-ray: 727b81454d677136-YUL
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
via: 1.1 google

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:43 GMT
Location: //sync-eu.connectad.io/pixel/1?dataid=data3&uuid=254dd7d3-92b7-4826-982b-da30ccf966f8
Server: nginx

GET
H2

204

1
sync.connectad.io/umatch/ Frame 8970
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=7517899671563583421

0
0

120ms
119ms

Document
text/plain

2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=7517899671563583421
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status: DYNAMIC
cf-ray: 727b81452ea4713e-YUL
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
via: 1.1 google

Redirect headers

content-length: 0
content-type: text/plain
date: Fri, 08 Jul 2022 20:17:43 GMT
location: https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=7517899671563583421
server: nginx

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 0C09 834 B
855 B 95ms
37ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: f2a7ab91f4f1ae23a0efd29f07f3bad827ef0ca3a6e41f6e441521e6aa2acb82

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 510
content-type: text/html
date: Fri, 08 Jul 2022 20:17:43 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2

204

1
sync.connectad.io/umatch/ Frame F588
Redirect Chain

https://creativecdn.com/cm-notify?pi=connectad
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=tTWIkAlvY1oGbv0lqHgF&pi=connectad

0
0

119ms
118ms

Document
text/plain

2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=tTWIkAlvY1oGbv0lqHgF&pi=connectad
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status: DYNAMIC
cf-ray: 727b81452ea3713e-YUL
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
via: 1.1 google

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 08 Jul 2022 20:17:43 GMT Fri, 08 Jul 2022 20:17:43 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=tTWIkAlvY1oGbv0lqHgF&pi=connectad
pragma: no-cache

GET
H2

204

1
sync.connectad.io/umatch/ Frame 5434
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=E8WhbNZHCQrNXmybSwypSL-y

0
0

141ms
121ms

Document
text/plain

2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=E8WhbNZHCQrNXmybSwypSL-y
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status: DYNAMIC
cf-ray: 727b8144fe60713e-YUL
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
via: 1.1 google

Redirect headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Connection: close
Date: Fri, 08 Jul 2022 20:17:43 GMT
Location: https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=E8WhbNZHCQrNXmybSwypSL-y
X-Sovrn-Pod: ad_ap3ewr1

GET
H3 200 usermatch Show response
ssum.casalemedia.com/ Frame FE6E 2 KB
2 KB 77ms
70ms Document
text/html 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b80f1df865869366e8fde05ab8631356d0682efc2a8ebb0295a274e59d342431

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 727b81448eeaa1e1-YYZ
content-encoding: br
content-type: text/html
date: Fri, 08 Jul 2022 20:17:43 GMT
dropped-udsids: 81|90|111|105|206|31|26|13
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ALfFlNfLto%2FyhgkzTLS9FI1XShGQcRBYdhT766tMQ5iYdeqSrebesLaBIbQiDtY1wYQ%2BQACs9hgMBeef0xvD9ryhP12%2BXnZJYvkzffK8PDQ6SD5k0GAKcshHha8Zn%2FLcvXINCUiD"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame DA37 2 KB
814 B 18ms
9ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5d4e109247a89f6

Requested by

Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 Cfk16x8YFwfZ8ipxMIm8vrclYFJKs7HhWgAi27yU Show response
csync.smilewanted.com/set_partner_userid_get/connectad/ Frame DDE4 0
580 B 138ms
131ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/connectad/Cfk16x8YFwfZ8ipxMIm8vrclYFJKs7HhWgAi27yU
Requested by: Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync-eu.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b81448c74e6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD0
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NzlmOTRhY2QtZjBmYy00Mzc1LTgyZWUtMjU2NzM2MDc3MjBi&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=1&google_push=ARnp8GC-...

170 B
188 B

42ms
42ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NzlmOTRhY2QtZjBmYy00Mzc1LTgyZWUtMjU2NzM2MDc3MjBi&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=1&google_push=ARnp8GC-tXMDkQ7M7QKfvIHTajgcg_T-fQ-F3xiR8rdXJhdTanUijk-BCsmqi-jLcVjbAJe4PZDjbeaH1WabOqZzPhElLotfhSY

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NzlmOTRhY2QtZjBmYy00Mzc1LTgyZWUtMjU2NzM2MDc3MjBi&google_gid=CAESEDWH341EUEZeKwQ5wAE4yJE&google_cver=1&google_push=ARnp8GC-tXMDkQ7M7QKfvIHTajgcg_T-fQ-F3xiR8rdXJhdTanUijk-BCsmqi-jLcVjbAJe4PZDjbeaH1WabOqZzPhElLotfhSY
date: Fri, 08 Jul 2022 20:17:43 GMT
content-length: 0
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame FFD0 0
34 B 43ms
21ms Image
text/plain 54.146.231.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEFBMK5JCbWBRPueZvQ3m_Ms&google_cver=1&google_push=ARnp8GCFRrp1YJIvVcByrh5H6sst6mdfN9T6m2-RDnnFqAVv8hMlmA_ZouWU9WWLAkpoperfoYZ3ojF-62ocvbSmwvt0tXppUfm0
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.231.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-231-30.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD0
Redirect Chain

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEAy0M4Yu5CzZMlogJmAY9cU&google_cver=1&google_push=ARnp8GBbINs-rKahnQxN1xRcg7tTVRHhUZUyfXldMVcuH-NQsVAqJVmyJ4Rhi9uOfY4U4...
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=ARnp8GBbINs-rKahnQxN1xRcg7tTVRHhUZUyfXldMVcuH-NQsVAqJVmyJ4Rhi9uOfY4U4qqwi-5PoTRhWG2YZolV1fBlwEv5YrZo&google_hm=QXk5QkZ6VTh0N2hXSU9hSjBo...

170 B
188 B

38ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=ARnp8GBbINs-rKahnQxN1xRcg7tTVRHhUZUyfXldMVcuH-NQsVAqJVmyJ4Rhi9uOfY4U4qqwi-5PoTRhWG2YZolV1fBlwEv5YrZo&google_hm=QXk5QkZ6VTh0N2hXSU9hSjBoaXpNTEE=

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=ARnp8GBbINs-rKahnQxN1xRcg7tTVRHhUZUyfXldMVcuH-NQsVAqJVmyJ4Rhi9uOfY4U4qqwi-5PoTRhWG2YZolV1fBlwEv5YrZo&google_hm=QXk5QkZ6VTh0N2hXSU9hSjBoaXpNTEE=
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD0
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEPhhUSNO5EK_kI7e4BPM-pE&c_param1=ARnp8GAXldKLmot2ZQJZf2Zh2lY9ivt3_FpytmWoPpUUsq0AZ5OmBChD3xBVM68TKHOSiMZ4xuCD74uCAbHK8EzWhIW_mprZKByv&gdpr=%%GDPR%%&...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ARnp8GAXldKLmot2ZQJZf2Zh2lY9ivt3_FpytmWoPpUUsq0AZ5OmBChD3xBVM68TKHOSiMZ4xuCD74uCAbHK8EzWhIW_mprZKByv

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ARnp8GAXldKLmot2ZQJZf2Zh2lY9ivt3_FpytmWoPpUUsq0AZ5OmBChD3xBVM68TKHOSiMZ4xuCD74uCAbHK8EzWhIW_mprZKByv

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ARnp8GAXldKLmot2ZQJZf2Zh2lY9ivt3_FpytmWoPpUUsq0AZ5OmBChD3xBVM68TKHOSiMZ4xuCD74uCAbHK8EzWhIW_mprZKByv
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx/1.19.0
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD0
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_hm=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB&google_nid=index&google_push=ARnp8GAllAWTVb3OQSY2NqKWdorW1_w8O73dL...

170 B
188 B

39ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_hm=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB&google_nid=index&google_push=ARnp8GAllAWTVb3OQSY2NqKWdorW1_w8O73dLocbxene68OVdJ6f45WdJavaLyvVa9OFrWjivbtW7ZqtHamW9jES7lonKxAtoczS

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VayiG1NonYqEeWCjAAYq5mTs6CeZ8gYY7uypD9ZPKchNQdyyfM%2BDeZJuFTMMPbFG6b4lTYXRrkLBN7RPzYnWcJzk9eVvJs6Y2ysTjGRjm%2F88jARhHFe7f61c%2FConh%2Fk2fyhIcn%2BKv%2Bh9Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_hm=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB&google_nid=index&google_push=ARnp8GAllAWTVb3OQSY2NqKWdorW1_w8O73dLocbxene68OVdJ6f45WdJavaLyvVa9OFrWjivbtW7ZqtHamW9jES7lonKxAtoczS
cache-control: no-cache
cf-ray: 727b8144ae2653dd-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD0
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEF...
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DARnp8GAY_-b69EGfnjfHERrgt...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ARnp8GAY_-b69EGfnjfHERrgtDNuZaxyxUlkWmgEEhtIOsGwvKzPE8UTMFkuKz8RWpPrB6r6yezc1ahHKrGQVy5QDAWuvA7k5zyt&google_hm=BT5SPn1BoUS6rpHxtbJd624

170 B
188 B

52ms
52ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ARnp8GAY_-b69EGfnjfHERrgtDNuZaxyxUlkWmgEEhtIOsGwvKzPE8UTMFkuKz8RWpPrB6r6yezc1ahHKrGQVy5QDAWuvA7k5zyt&google_hm=BT5SPn1BoUS6rpHxtbJd624

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Tengine
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ARnp8GAY_-b69EGfnjfHERrgtDNuZaxyxUlkWmgEEhtIOsGwvKzPE8UTMFkuKz8RWpPrB6r6yezc1ahHKrGQVy5QDAWuvA7k5zyt&google_hm=BT5SPn1BoUS6rpHxtbJd624
Connection: keep-alive
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEDEkPeZIJFQdRNhzsZgIbwk&google_cver=1&google_push=ARnp8GBa7WyqcSQeOCPTJOFQLehx0W3W3o5YkUE4HgE--EuW5WKN7xOJpLtaZA2Yd2m2_D0csY...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uNnRXWkFCRTJ1R1c1NDJnVXFwRDBWWHhGdEdNeWlTMX5B&google_push=ARnp8GBa7WyqcSQeOCPTJOFQLehx0W3W3o5YkUE4HgE--EuW5WKN7xOJp...

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uNnRXWkFCRTJ1R1c1NDJnVXFwRDBWWHhGdEdNeWlTMX5B&google_push=ARnp8GBa7WyqcSQeOCPTJOFQLehx0W3W3o5YkUE4HgE--EuW5WKN7xOJpLtaZA2Yd2m2_D0csYnW6TiAggowzvBZPfWlwSjXKj2D1g

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uNnRXWkFCRTJ1R1c1NDJnVXFwRDBWWHhGdEdNeWlTMX5B&google_push=ARnp8GBa7WyqcSQeOCPTJOFQLehx0W3W3o5YkUE4HgE--EuW5WKN7xOJpLtaZA2Yd2m2_D0csYnW6TiAggowzvBZPfWlwSjXKj2D1g
date: Fri, 08 Jul 2022 20:17:43 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame FFD0 0
12 B 53ms
41ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LOv_VvAutwsB8PEJcKR4XLCqVyp1WEZWTFNcH0YlJYwAU21Ll8UlNKL9IaieUYyYpq9BmNFA

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.120.47.161.5.clients.your-server.de

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

rtb-h Show response
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame EE97
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=12f6281c-b70c-4521-a5d1-738348ad6a8e-tuct9c21667&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
149 B

129ms
83ms

Document
text/plain

151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=12f6281c-b70c-4521-a5d1-738348ad6a8e-tuct9c21667&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
content-length: 0
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yul12834-YUL
x-timer: S1657311463.271612,VS0,VE73

Redirect headers

accept-ranges: bytes
content-length: 0
date: Fri, 08 Jul 2022 20:17:43 GMT
location: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=12f6281c-b70c-4521-a5d1-738348ad6a8e-tuct9c21667&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yul12825-YUL
x-timer: S1657311463.193070,VS0,VE21
x-vcl-time-ms: 21

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 0657
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=Z8xyczZTAh6vZ6wn55DIYg

42 B
308 B

20ms
20ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=Z8xyczZTAh6vZ6wn55DIYg
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 08 Jul 2022 20:17:43 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 20:17:43 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=Z8xyczZTAh6vZ6wn55DIYg
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame 638A 0
0 94ms
25ms Document
text/plain 5.161.47.120
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

5.161.47.120 , Germany, ASN213230 (HETZNER-CLOUD2-AS, DE),

Reverse DNS

Software

nginx/1.21.4 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx/1.21.4
Strict-Transport-Security: max-age=15768000

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 483C 43 B
281 B 503ms
122ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:43 GMT
Vary: Accept-Encoding
X-adserver-worker: ragnarok-d725776a7b1f@version_1.518v3
X-core-time: 0ms
X-server-arch: v2

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2652
Redirect Chain

https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0

0
74 B

21ms
20ms

Document
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 10:05:11 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 727b8144cd247144-YUL
content-length: 0
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
server: cloudflare

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 2CDC
Redirect Chain

https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=79f94acd-f0fc-4375-82ee-25673607720b

1 B
53 B

23ms
22ms

Document
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=79f94acd-f0fc-4375-82ee-25673607720b
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 10:00:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Fri, 08 Jul 2022 20:17:43 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=79f94acd-f0fc-4375-82ee-25673607720b
strict-transport-security: max-age=15724800; includeSubDomains

GET usersync
match.bnmla.com/ Frame 2C4D 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame DB45
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:472EAFCEE13948B5AAD5A88A32E34BD1

1 B
53 B

23ms
22ms

Document
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:472EAFCEE13948B5AAD5A88A32E34BD1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 08 Jul 2022 20:17:43 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 138
content-type: text/html
date: Fri, 08 Jul 2022 20:17:43 GMT
expires: Thu, 07 Jul 2022 20:17:43 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:472EAFCEE13948B5AAD5A88A32E34BD1
server: nginx
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H2 200 E614708A-96BB-452C-8A92-C68CD106CB31 Show response
csync.smilewanted.com/set_partner_userid_get/pubmatic/ Frame ABB7 0
553 B 152ms
144ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/pubmatic/E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 727b8144ccb6e6e0-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:43 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

GET
H2

204

/
spl.zeotap.com/ Frame 5D21
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=E614708A-96BB-452C-8A92-C68CD106CB31
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=70b3e8d7-cc97-480b-80ee-dad476c341d7&icm&gdpr=0&gdpr_consent=&cver
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=2c75c8cb9e71b90d8d3f531a8aba0216&gdpr=0
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=62a25a578f835543/gdpr=0/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%...
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=3eda220bd613d9f902fa275c6ac3c751&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=62a25a578f835543

0
56 B

58ms
56ms

Image
text/plain

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spl.zeotap.com/?zdid=1332&zcluid=62a25a578f835543
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 727b814b9eba4bb9-YUL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

Redirect headers

location: https://spl.zeotap.com?zdid=1332&zcluid=62a25a578f835543
content-length: 0

GET
H2

200

Artemis
aud.pubmatic.com/AdServer/ Frame 5D21
Redirect Chain

https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=E614708A-96BB-452C-8A92-C68CD106CB31&gdpr=
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=E614708A-96BB-452C-8A92-C68CD106CB31&gdpr=&fbounce=1
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=E614708A-96BB-452C-8A92-C68CD106CB31&addseg=12,35,41

0
0

330ms
24ms

Image
application/json

8.28.7.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=E614708A-96BB-452C-8A92-C68CD106CB31&addseg=12,35,41
Protocol: H2
Server: 8.28.7.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Redirect headers

date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
p3p: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location: https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=E614708A-96BB-452C-8A92-C68CD106CB31&addseg=12,35,41
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type: text/html; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame 5D21
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=E614708A-96BB-452C-8A92-C68CD106CB31&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=E614708A-96BB-452C-8A92-C68CD106CB31&sInitiator=external&gdpr=0&gdpr_consent=

42 B
603 B

31ms
30ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=E614708A-96BB-452C-8A92-C68CD106CB31&sInitiator=external&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Frontend-ID: 9
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: image/gif
Content-Length: 42
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Frontend-ID: 2
Location: /pubmatic/1/info2?sType=sync&sExtCookieId=E614708A-96BB-452C-8A92-C68CD106CB31&sInitiator=external&gdpr=0&gdpr_consent=
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Length: 0
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 5D21 43 B
653 B 150ms
59ms Image
image/gif 13.225.214.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=E614708A-96BB-452C-8A92-C68CD106CB31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-117.ewr50.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 94ac78512342d473815908b66b16cd7c.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: EWR50-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: pUzUxt_9JdYw3kD4pSYD98zUQtBOIS2QoAE_WGRvDexramj173NKuw==
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 5D21
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:eec05824-da88-42b2-a03f-baae3fa7c9bd&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

21ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:eec05824-da88-42b2-a03f-baae3fa7c9bd&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 09:19:17 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:eec05824-da88-42b2-a03f-baae3fa7c9bd&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2 200 d1ba4609
rtb.gumgum.com/getuid/ Frame 5D21 35 B
209 B 113ms
23ms Image
image/gif 34.236.46.198
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.46.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-46-198.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame EDBD 1 KB
753 B 30ms
25ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3337
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js Show response
pagead2.googlesyndication.com/bg/ Frame 7FC0 36 KB
14 KB 30ms
25ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c12f2da086c2408f3f1255b457b7798f793cf77f792c14c66fdbb9bf3c3eaa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 19:02:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 177329
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13888
x-xss-protection: 0
last-modified: Fri, 01 Jul 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 06 Jul 2023 19:02:14 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E9F5 0
0 60ms
59ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CxFYG5pDIYtT3EbeJjvQP_IWNsALskq2RYPfa0tOsDMCNtwEQASAAYMmG_4fwo-wSggEXY2EtcHViLTg2NzY1NjA1OTgyOTY2ODKgAZX1m98DyAEJ4AIAqAMBqgT-AU_Qb-0krV65_LNf4wWaoOIJyIVqE7mGe53FI5WRJU7CpGvYx9kiiyr8FcbxwCqEWARCEoW2v-M_BU10b59iUhpvocT5yxJ06GCb7pNiPicSseiGk4NXfraWaSrSpc_W1Pvl0-VknQb8SFJVWH4g-SH90Bf_8zlGipAbq2gCnsnI4vuN2_YsLAsTd5xRxSfUoW2VjiXidGGskY5feKTJXrPdhltrMapek1haC3e1TrpD83ONM0d9EYg_afsV_pNCcFQubz1Mldmf1URsoKF4ZFkJbJiw8zsJeYtCCRuP9emSqteh994lxjCtR3_3VfVLuAvXq7oCDP6PtkDBC-S44AQBgAaR4uiK2-exnAegBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi04Njc2NTYwNTk4Mjk2NjgyGILfIg&sigh=8e0UbWnEvMg&uach_m=[UACH]&cid=CAQSPACNIrLMyQk-4GUWenMiMgSX06m44AVaxDbRawNTxtMCPnVsySHKP7QnOu_Xz4ek3_L6dtHp84aMOl1xhxgB
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 log
hblg.media.net/ Frame E9F5 35 B
0 40ms
17ms Fetch
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hblg.media.net/log?logid=kfk&evtid=l1log&app=0&cc=US&ctr=5.1813474E-4&viewability=90&device_id=4&cbdp=0.218&slotVisibility=1&dn=xmod.in&acid=a5902f4ddc86467d8171c7bce5cb1909&ugd=4&size=728x90&pvid=294&csip=rtb-appnexus-7cfb9985db-74jlf.SC&ogbdp=0.32&sc_pvid=319&prvReqId=28894217709805_720695613_11621109112941&itype=ADX&requrl=https%3A%2F%2Fxmod.in%2Fblog&scrid=1700080805857300728009000001000&mang=1&bidrestime=1657311462422&cid=8CUU9JF8H&rme=nurl
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame E9F5 35 B
0 32ms
20ms Fetch
image/gif 23.219.92.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&ckfl=0&lper=&app_type=adx&bdr_typ=1&ss_d1=0&ogerpm=0.3200&ss_d2=0&stid=&other_prv=319%7C294&jar_err=&current_day=5.0&adtyp=0&req_id=YsiQ5gAFc1wKh-eNngTbdA&bd_m3=0.0000&bidfp=0.0100&bd_m2=0.0000&pvag_id=&bd_m1=0.0000&ugd=4&dim10=false&predicted_wr=75.2887&exp=&second_bidder=319&search_res=32&floor_bucket=0.00&gpid_format=&seat=BID_API&size=728x90&url_l1=blog&f_seg=segment_broad_technology_computing&prdp=0.2176&ogcbdp=0.3200&dfpbd=0.2176&server=1&ogerpm_wd_bkt=0-1&model_version=202207081116_generic_adx_1-cid_0&viewability=0.9000&dmm_r=0.0000&cut=32&dmm_l=0.0000&as_cache=1&tcyerpm=&sc=IL&send_erpm=true&dmm_m9=0.0000&sd=1&hb_exp=&seg=arc_health_8%2CComputing%2Ccpa_auto_ins_pop_cat%2Ccpa_auto_ins_pop_cat_mixed%2Ccpa_wheels_ap%2CInternet%2Csegment_broad_technology_computing%2CSocial_Networking%2CTechnology_and_Computing&dmm_m4=0.0000&erpm_bucket=0.30&ugd_ver=&requrl=xmod.in%2Fblog%2F&bidrestime=1657311462422&cc=US&strg=harmony&ss=&current_hour=20&time_stamp=2022-07-08+20%3A17%3A42&model_key=generic_adx_1-cid_0&rvshhon=&mul_ratio=0.0000&bdp=0.3200&ct=Chicago&akey=&mnckfl=0&bdp_bucket=0.30&algo=&dc=east_sc&splid=&dn=xmod.in&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F103.0.5060.53+Safari%2F537.36&buyer_id=&bdp_wider_bucket=1&acid=a5902f4ddc86467d8171c7bce5cb1909&infl=&o_ver=NT+10.0&br_ver=103.0.5060.53&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m5=0.0000&ver=8.12.0&totalTimeBucket=2&visibility=1&totalTime=2334371&dmm_m1=2022-07-08+20%3A17%3A42.424691957&e_rpm=0.0000&dmm_m22=0.3200&gdpr=&vsid=&log_less=false&gpid_sent=false&ogerpm_used=false&bdmm_m12=0.0000&cid=8CUU9JF8H&bcrid=1700080805857300728009000001000&rawbid=0.3200&seat_id=BID_API&sub_bidder=196&pst=EMS&pbshr=100.0000&dmm_d10=&o_id=101&clisp=rtb-appnexus-7cfb9985db-74jlf.SC&dfp_bucket=0.2&adblk=1220607417&itype=adx&pvid_seat=294_BID_API&cliIP=2503514368&advurl=search.yahoo.com%2F&level_base=0&crid=116211091&sat=1&br_id=265&cut_bkt=30&gpid=&iwb=1&second_bid=0.010000&sc_pvid=294&capd=0&other_bids=0.01%7C0.32
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.219.92.153 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-219-92-153.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame E9F5 159 KB
55 KB 57ms
34ms Script
text/javascript 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

710391de79618c61dd3c6e98787285272df4e59226123a843e3c27711aff951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-mnt-h: 21-6005
content-encoding: gzip
etag: "5b6386cd34f16b09783f941fc0e33c38"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Fri, 08 Jul 2022 20:17:43 GMT
x-cache-hits: 0
strict-transport-security: max-age=31536000
x-mnt-w: 8-8
expires: Fri, 08 Jul 2022 20:22:43 GMT

GET
H2 200 adperformance.js Show response
warp.media.net/rtb/resource/ Frame E9F5 61 KB
62 KB 41ms
19ms Script
application/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resource/adperformance.js?v=35e90bcdc8

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

3378135f525fc551ce49d2c117e9967735794757a4c71910d8c1b8fa38bf3f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=604800
server: nginx
date: Fri, 08 Jul 2022 20:17:43 GMT
content-type: application/javascript;charset=ISO-8859-1
cache-control: max-age=53696
access-control-allow-credentials: true
content-length: 62892
expires: Sat, 09 Jul 2022 11:12:39 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame E9F5 3 KB
1 KB 32ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 764
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E9F5 137 KB
42 KB 61ms
49ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame E9F5 17 KB
7 KB 32ms
21ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 666
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E9F5 0
0 49ms
38ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ4VUnQH6aGXzbBpPXtihXcqK-pnc5tLCHkkA8CogGG6qBi-DZODb9m2x1TYjKweIpIz8OLBd2fUiaV6Etv8UHjqYMfzA
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame E9F5 22 KB
7 KB 32ms
21ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 06:34:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222173
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 06 Jul 2023 06:34:50 GMT

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 981C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=17184-d&khaos=L5CWGBJG-1Y-B9H5
https://sync.adtelligent.com/csync?t=a&ep=323557&extuid=L5CWGBJG-1Y-B9H5

0
387 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=323557&extuid=L5CWGBJG-1Y-B9H5
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:42 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://sync.adtelligent.com/csync?t=a&ep=323557&extuid=L5CWGBJG-1Y-B9H5
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H2 200 smtr Show response
contextual.media.net/ Frame 4E15 67 KB
27 KB 505ms
487ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TFY50V9&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463271061731&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=8fOnRrolnfOur8B4zx%2FBge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808001265&kapc=10&ekals=775EJvu99ui%7C%7CENvu9%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

c3275d5bfd983a338ed169629e630c7344d7ca88c9d67962d1a14f8d829d3bd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 27277
content-type: text/html
date: Fri, 08 Jul 2022 20:17:43 GMT
expires: Fri, 08 Jul 2022 20:17:43 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-sc-h: 21-lx97
x-sc-w: 21-3254

GET
H2 200 bping.php
lg3.media.net/ Frame DCF8 35 B
189 B 35ms
16ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=531&&gdpr=0&prid=8PRN625DH&cid=8CU5RJ1PV&crid=845116586&vi=1657311463271061731&ugd=4&lf=6&cc=CA&sc=QC&vsid=3003130611454751&lper=100&wsip=2886781036&r=1657311463210&requrl=https%3A%2F%2Fxmod.in%2Fblog&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=16276&vgd_rakh=1657311462190909608&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_pgid=p1947862235t202207082017&vgd_pgids=1&vgd_uspa=0&hvsid=00001657311463206025035145478280&gdpr=0&vgd_end=1

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:43 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 4A94 15 B
216 B 30ms
21ms Script
text/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=4657&&&vgd_l2type=sca&fp=yzzAfwSZMQYDIuI3H0cMifOjuM6fa10xmptSGrGHiHCRmZJpDpwg-6iMEoe0xaQUGZBnWRO6lH2R1L2zKeAnIFBz_xTc8vBRiQegyqCEJhjCLLkaGYmIihITNC9bQ1ao&cme=rHdfi4q4KS55Ds4Iembpor8DW7_3csN7vDjEm_eVhHD4QdO5dM0NB5W-VR6bRbp3aKsg8zWHFx94KL4YVTU3e6dMOIPwGybCf51f3m5Dansx5TZLpXLlxrs4hhEcNwjRWTd62NSvIzrCxD2Egq-ew9CazNNTpErQNP5geqP2FSlCMg23BoJZzza4UFqBppnA8crfuPl1xzzi7Fiai9DpKGxmctxl-bZG%7C%7CJwgYdc1KQkFA0AkMtcoUY9olDV92JfOo%7Ca0AmFUYXmD6YYKAfSVuGWyUY6vyv8InEJ2xnHJ5H_0o%3D%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7CqMxMFmkA2wR5WXnN6pGQwDONfEKZ93SPTqaLCHv3vyHuFrZkfXqvaBKPdYoBOth8wH321N16idBrRBpf-nx7lG0kcN3j2aEHWwSNgDbFa1aZEWEimFAU_D8rgHmrF5ynG6ZXLi-ND5oBSwEQIuyzdwb9wKY5_42mDEFvcIbfEv_y4En22nssJyApMmMr5fGJ0FfXXV-5dpmJuOsuNQlhpic_wgWS_zCAqwZgI9QI9ZSbmX_sJ9e-aazZ1kYN-5S987dtqfVoIWc%3D%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7C&v=1&geo=45.5%7C-73.58&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=&cc=CA&wsip=170721322&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nfu&vgd_fm_lang=EN&vgd_dnquo=00_XX&ksu=224&fdkt=65&vgde_kbbh=fuoyxQBuG&kwd[]=10+Best+Auto+Insurance+Rates&kwt[]=65&kbc[]=not+found&kwp[]=1&kid[]=330067967&kbc2[]=5%3D1034%7C6%3D1%7C16%3D3%7Co_r%3D0.33%7Cp_r%3D0.28%7Cl_r%3D138%7Cc%3D555%7C17%3D13.43%7C18%3D-1%7C19%3D13.72%7C1%3D3.44%7C2%3D13.58%7C3%3D0.74%7C4%3D1.00&ktd[]=274894684672&kwd[]=5+Best+Stocks+to+Buy+Now&kwt[]=375&kbc[]=112232&kwp[]=2&kid[]=322494104&kbc2[]=%23c%3A3473961%7Co_r%3D0.00%7Cp_r%3D0.12%7Cl_r%3D44%7Cc%3D-261%7C17%3D1.97%7C18%3D-1%7C19%3D1.97%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C1%3D0.81%7C2%3D10.43%7Cps%3D0.976%7C3%3D1.04%7C4%3D4.00&ktd[]=1126174818304768&cid=8CU5RJ1PV&vwid=1657311461246412568&vi=1657311461246412568&tdAdd[]=ib%3D0&vsid=3003130611454751&tdAdd[]=asnum%3D16276&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_l3_sc=QC&vgd_chost=contextual.media.net&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_kals=ttype%3D10019%7C%7Cpc%3D16%7C%7Cfat%3D1&vgd_kalog=HID%3D2%7C%7CSID%3D8%7C%7CUUID%3Dh8qAqUBh3ezbHu4Kj%7C%7CTLID%3D6%7C%7CSI%3D2750%7C%7CMI%3D2750%7C%7CCI%3D2748%7C%7CTPTD%3D565939259188228%7C%7CMPTD%3D128&vgd_katid=808058298&vgd_katbid=-21&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170721322&vgd_nrrv=54023&vgd_nrrmf=4848&vgd_nrrsf=scrr&vgd_cty=montreal&vgd_go_pid=8POPGE52H&&vgd_ifrmode=14&vgd_l1rakh=1657311461178968406&sttm=1657311461982&upk=1657311462.20363&hvsid=00001657311461982025035145472055&verid=3111299&vgd_matchstr=hr%3D1%7C&sbdrId=186&vgd_vsidtv=000V10&vgd_ecrid=8032948058298&vgd_isiolc=1&vgd_fcm_enc_mis=1&&kbbq=%26asn%3D16276&&vgd_vstrid=3003130611454751&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYvu.uh~e8QMQOvuii~xLjMLEQMGvF.HA~OmYMGvu~ONfvu~QNOv%20N~eM1QzvuFfhF~OmYMjvf9~ejfLMQOvf9ff9h9W9W~8xLjMGvhuh.uu~xLjM7UNvi~xLjMLf1MGv9~Q7Ov~c0v.*Gjmy.*~j1Q7v~e8QMxLjMGv9.XH~8Evf6%20xQ9~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vH9~LNvu~L8Qx8Ov9%2C9~LEQMQOvf9ff9h9WuA~e8QMGvFFH.if~xLjMGvu.Ai~ejfLMxLjMGv9.9f~ejfLMxLjMe8vHh9~xLjM7e8vHFF~xLjMjvf9~yN17vX9u9ff~GGvuWF~eev9~NejfLMQOvuiF~jfLMGvu999~JLEYvu.uh~ejfLMxLjMUNvu4u~ejfLMxEMjvf9~GYvu~Q8OvWHXuuFXWF~QOvu~x8OvwWyLps%20IbGdCfJIfp~xLjMLEQMUNvu~NejfLMGvA.uf~G7OviHfWXAf9HuXfHf9fuA9XuiiiuHuiWA9iXF9XHFHAuHFhHuhuhXHihfiFfHhuhufAFuAAi9WWW9uhif~Nejfvui.hf~AENkvu999.Au~x8Yv9~OYYMQ7Lyvw1LYmz5~ejfLMxEMGv9.9f~QQvIK~x8Bvou~NJv9~LEQMGvuAX.Wh~xLjMQLEQMGvuW.AH~%3DVvfh9f~z7Qvu~c0fv.*Gjmy.*~7Gvou~N7vYmz7LJ1j~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~0sv9~8Q8kv9~jNvu~xLjMLENMGv9~G8Ovu.uh~ONvW~xLjMLEQMLev9~ejfLMGvuf.if~QxEEj5M71yM8Ov~e8JB1G8j875v9.Wf~1YEvu~NGOEvu.uh9~OYYvw1LYmz5~Qx8Ov%3DK4b44rGGRBa3xyPit_y_rmk4Bc~QyY7vQJyYJz7MGLm1OM7JNwzmjmy5MNmYEx78zy~QOvu~O7NvJ1Q7MQN~-8OvKrtoExGoWFhFXF9XiWfiFFWf~O1jyv~w7Yjvu~1OGjUvfiWhAfFFFW~QmGEv9.9A~N7Lv9.99AfhfHfiW~GOEN1EOv9~OYYMJLEYv7LxJ~GkjLv9.9u9~myG8Ovu.uh9~1NM75EJvu~875EJM8Ovuh~QJjjJLM71yM8Ov~1OMGjUMUJ5vfiWhAfFFFW~OJ7JN7JOM71yM8Ov~ONx7vfX~OmyGvuof~8GNvu~OO7vou~zQlvu~7yQvA99-fX9~GQGv9~GQEv9~7Y-vfHX&vgd_optout=0&vgd_cfud=220324&vgd_scsver=258&vgd_go_ent=1&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_dtc=east_sc&vgd_mbr=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250&&vgd_uspa=0&vgd_sc=QC&vgd_l1rhst=contextual.media.net&hvsid=00001657311461982025035145472055&subBdr=186&bdrid=294&rc=0&rand=1657311462792&acid=ac81f1a732804817a3e6b39a3524d188&matm=1657311462792&vgd_ltimesrc=1&vgd_ltime=1483&vgd_rtime=1053&vgd_etm=8&vgd_l1hcsd=O6005%7C4504&vgd_tcf_cmp=1&vgd_l1ch=1&vgd_lhl=2896&vgd_pgid=p1947862235t202207082017&vgd_adprefflag=10&vgd_adpref_diff=100&vgd_csip=rtb-appnexus-7cfb9985db-4xzfz.SC&vgd_sbSup=1&vgd_vsidv=10&vgd_nrrs=54023&vgd_cntrdt=SF%7Cb97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T586N56&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311461246412568&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=B4zx%2F8fOnRrolnfOur8Bge4B&bdrId=294&ntv=0&matchstring=hr%3D1%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058298&kapc=16&ekals=775EJvu99ui%7C%7CENvuF%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:43 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H3 200 PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js Show response
pagead2.googlesyndication.com/bg/ Frame 0358 36 KB
14 KB 24ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c12f2da086c2408f3f1255b457b7798f793cf77f792c14c66fdbb9bf3c3eaa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 19:02:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 177329
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13888
x-xss-protection: 0
last-modified: Fri, 01 Jul 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 06 Jul 2023 19:02:14 GMT

GET
DATA 200
OK truncated
/ Frame E63E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c0209462ce989e3feb3a0493940167df7ed125bc77a83d14c5048c6ce8ae111

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 um
sync.e-planning.net/ Frame 9548 42 B
103 B 23ms
22ms Image
image/gif 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?dc=bcf310d1654d268f&iss=1&uid=d710d8f2-8e5e-421e-ad80-037876891ad3
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: openresty
content-type: image/gif

GET
DATA 200
OK truncated
/ Frame 79C8 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 79C8 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK Poppins_SemiBold.woff
res-a.akamaihd.net/__media__/fonts/Poppins_SemiBold/ Frame 79C8 21 KB
22 KB 19ms
18ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Poppins_SemiBold/Poppins_SemiBold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TV51ISA&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311462524544321&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=8fOnRrolnfOur8B4zx%2FBge4B&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808128972&kapc=7&ekals=775EJvu99ui%7C%7CENvh%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ce7a35c5cd3e8b2eadf4d8c07e1631c09d409f2ac11bece40e6e15211b18c27e

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Last-Modified: Tue, 31 Jan 2017 09:18:23 GMT
Server: nginx
ETag: "5890565f-55b8"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21944

GET
H/1.1 200
OK Poppins_Bold.woff
res-a.akamaihd.net/__media__/fonts/Poppins_Bold/ Frame 79C8 21 KB
21 KB 19ms
18ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Poppins_Bold/Poppins_Bold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TV51ISA&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311462524544321&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=8fOnRrolnfOur8B4zx%2FBge4B&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808128972&kapc=7&ekals=775EJvu99ui%7C%7CENvh%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ab0d99a570f1a73138d44dbf0b7f361a4b1cb86529a14ef41e9828b00c62b883

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Last-Modified: Thu, 15 Dec 2016 16:30:17 GMT
Server: nginx
ETag: "5852c519-5464"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21604

GET
H/1.1 200
OK Poppins_Regular.woff
res-a.akamaihd.net/__media__/fonts/Poppins_Regular/ Frame 79C8 124 KB
124 KB 20ms
19ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Poppins_Regular/Poppins_Regular.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TV51ISA&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311462524544321&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=8fOnRrolnfOur8B4zx%2FBge4B&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808128972&kapc=7&ekals=775EJvu99ui%7C%7CENvh%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: d418cfc8510d0bfb42c808cd368ee91ab0a71c8c4b321ea47cf76c468c34eaba

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Last-Modified: Wed, 09 Nov 2016 16:33:23 GMT
Server: nginx
ETag: "58234fd3-1ef30"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 126768

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 502C
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEC6ebXenuZR9P0OTJ2RIp88&google_cver=1&google_push=ARnp8GAvcUnrXXEcyxmpaocEUaGP4hoXx_F5oJSWkDZ8_6G4K3AyV3nuKG36FhnX_Nqc-z_gjNj6iN0kvVULIHSFtsO-_DBLSGo
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=472EAFCEE13948B5AAD5A88A32E34BD1&google_push=ARnp8GAvcUnrXXEcyxmpaocEUaGP4hoXx_F5oJSWkDZ8_6G4K3AyV3nuKG36FhnX_Nqc-z_gjNj6iN0kvVULIHS...

170 B
188 B

39ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=472EAFCEE13948B5AAD5A88A32E34BD1&google_push=ARnp8GAvcUnrXXEcyxmpaocEUaGP4hoXx_F5oJSWkDZ8_6G4K3AyV3nuKG36FhnX_Nqc-z_gjNj6iN0kvVULIHSFtsO-_DBLSGo

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=472EAFCEE13948B5AAD5A88A32E34BD1&google_push=ARnp8GAvcUnrXXEcyxmpaocEUaGP4hoXx_F5oJSWkDZ8_6G4K3AyV3nuKG36FhnX_Nqc-z_gjNj6iN0kvVULIHSFtsO-_DBLSGo
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 07 Jul 2022 20:17:43 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 502C
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEJG19ih6vIbElKc0wSqMkp4&google_cver=1&google_push=ARnp8GBV0Az8bCMxnxQ7RqrWzQ3PMRIU5wUgiz0ybIHOWtqBOISFIFG32L7UbecMWTX07tQUu0tssmb5zqK4ZATc6e...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7

170 B
188 B

56ms
56ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 502C
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFJfdJadiJakXqnZAbusCXo&google_cver=1&google_push=ARnp8GDYmxJO3g0bmiBvMKcV3sFaS4hbzvCiItnxwO-W6cgH_a89ueOV7RizMqBGt1qJOegRnBypMkldm9Z6IVhWB4C3...
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp...
https://x.bidswitch.net/sync?dsp_id=440&ssp=google&user_id=yppNZ0aXUllDfBUtasOQ0
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ARnp8GDYmxJO3g0bmiBvMKcV3sFaS4hbzvCiItnxwO-W6cgH_a89ueOV7RizMqBGt1qJOegRnBypMkldm9Z6IVhWB4C3DAWKog&google_hm=JU3X05K3SCaYK9owzPlm-A==

170 B
188 B

38ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ARnp8GDYmxJO3g0bmiBvMKcV3sFaS4hbzvCiItnxwO-W6cgH_a89ueOV7RizMqBGt1qJOegRnBypMkldm9Z6IVhWB4C3DAWKog&google_hm=JU3X05K3SCaYK9owzPlm-A==

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ARnp8GDYmxJO3g0bmiBvMKcV3sFaS4hbzvCiItnxwO-W6cgH_a89ueOV7RizMqBGt1qJOegRnBypMkldm9Z6IVhWB4C3DAWKog&google_hm=JU3X05K3SCaYK9owzPlm-A==
Date: Fri, 08 Jul 2022 20:17:44 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 502C
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENXocMcldTMxQT3EY-SMxUI&google_cver=1&google_push=ARnp8GCGJAMBuE0P04Ojjs2Suxjcpe6sUjb6hP79xBVgg17cVsLZA9awG2BjIlUPfLPX0XNJ_P57el3S...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GCGJAMBuE0P04Ojjs2Suxjcpe6sUjb6hP79xBVgg17cVsLZA9awG2BjIlUPfLPX0XNJ_P57el...

170 B
188 B

44ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GCGJAMBuE0P04Ojjs2Suxjcpe6sUjb6hP79xBVgg17cVsLZA9awG2BjIlUPfLPX0XNJ_P57el3S9gkogrN6q9lVHrqGbIE

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GCGJAMBuE0P04Ojjs2Suxjcpe6sUjb6hP79xBVgg17cVsLZA9awG2BjIlUPfLPX0XNJ_P57el3S9gkogrN6q9lVHrqGbIE
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 502C
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEILR6rPoSo3EeHktcApbG4Q&google_cver=1&google_push=ARnp8GBTpIuonUVD83lameDQDvBmwXw-7BoiLWjTmMBZlae04WeAGEi8fBY8KNlkAoq5Zm1Cl7Wuog15fR6rTCO4su...
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GBTpIuonUVD83lameDQDvBmwXw-7BoiLWjTmMBZlae04WeAGEi8fBY8KNlkAoq5Zm1Cl7Wuog15fR6rTCO4suo8...

170 B
188 B

45ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GBTpIuonUVD83lameDQDvBmwXw-7BoiLWjTmMBZlae04WeAGEi8fBY8KNlkAoq5Zm1Cl7Wuog15fR6rTCO4suo8pt6yfw

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GBTpIuonUVD83lameDQDvBmwXw-7BoiLWjTmMBZlae04WeAGEi8fBY8KNlkAoq5Zm1Cl7Wuog15fR6rTCO4suo8pt6yfw
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 502C
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEH7XH_NvafWPOChDoAjA1nU&google_cver=1&google_push=ARnp8GAEmE8U7sZy4KfvNdisC8f7y-Nw8w3ZiV58yGz7L0i1sFSbsfrMN0Q0jK44VZLr4e7U6DO_hu...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GAEmE8U7sZy4KfvNdisC8f7y-Nw8w3ZiV58yGz7L0i1sFSbsfrMN0Q0jK44VZLr4e7U6DO_huhYmtWWQD30J4_NrtXKc6w&google_hm=NzIzNDI5NjA...

170 B
188 B

37ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GAEmE8U7sZy4KfvNdisC8f7y-Nw8w3ZiV58yGz7L0i1sFSbsfrMN0Q0jK44VZLr4e7U6DO_huhYmtWWQD30J4_NrtXKc6w&google_hm=NzIzNDI5NjA5ODg1NDQxMjU5Ng%3D%3D

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GAEmE8U7sZy4KfvNdisC8f7y-Nw8w3ZiV58yGz7L0i1sFSbsfrMN0Q0jK44VZLr4e7U6DO_huhYmtWWQD30J4_NrtXKc6w&google_hm=NzIzNDI5NjA5ODg1NDQxMjU5Ng%3D%3D
date: Fri, 08 Jul 2022 20:17:43 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 502C
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEOfv9xDapWJMOuOVoXPivnI&google_cver=1&google_push=ARnp8GCMLyxBkcEhAoWRakGtRbKKJ_j7RrH2K_VUM1LtfAzvpkLUvUd_OTo9gDsaeksgR8E4hPly9VbwCBomMkw_TNAqyS-...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ARnp8GCMLyxBkcEhAoWRakGtRbKKJ_j7RrH2K_VUM1LtfAzvpkLUvUd_OTo9gDsaeksgR8E4hPly9VbwCBomMkw_TNAqyS-Q5HnM&google_hm=MTc4Mzc3NzM...

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ARnp8GCMLyxBkcEhAoWRakGtRbKKJ_j7RrH2K_VUM1LtfAzvpkLUvUd_OTo9gDsaeksgR8E4hPly9VbwCBomMkw_TNAqyS-Q5HnM&google_hm=MTc4Mzc3NzMxNDAwNTI4ODg4MQ==

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ARnp8GCMLyxBkcEhAoWRakGtRbKKJ_j7RrH2K_VUM1LtfAzvpkLUvUd_OTo9gDsaeksgR8E4hPly9VbwCBomMkw_TNAqyS-Q5HnM&google_hm=MTc4Mzc3NzMxNDAwNTI4ODg4MQ==
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 502C 0
12 B 36ms
34ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IPd203aPJTkYPrMIVjyF0whwDHE0wJ5l26EubLuXYVz2F0Qk0T7r9rjbOUlVz8h6ohbAPomQ

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 73E9 26 KB
9 KB 39ms
38ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

51-158-29-13.rev.poneytelecom.eu

Software

Apache /

Resource Hash

4a34cf7a580b600dbbba734ec62fcb28f479657a859944722e1b1e99ff42e4da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 9326
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:43 GMT
expires: Sun, 10 Jul 2022 20:17:43 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 clog
hblg.media.net/ Frame DCF8 35 B
172 B 20ms
19ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/clog?logid=awlog&pixel_len_bucket=4917&lmt_enf=true&req_mtype%3C%3E=0&mx_nsz=1&spSource=0&ifst=0&vid=YsiQ5gACcHwKh7MHKwvEgQ&s_city=charleston&ugd=4&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D2%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1%7Ctpi%3D1&app=0&ctr=0.0016823688&mx_TAF=2&sc_bdp=0.020&device_id=4&ae=false&mx_UCC=4&prspt=headerBid&mx_bss_algos%3C%3E=0&usp_status=0&seat=BID_API&og_cbdp=0.510&size=300x250&mx_TAS=1&mx_gpid_sent=false&xtmax=290&commit_id=6ac920ad&scrid=1700080800126500300025000001000&itypeid=17&mx_SPRIG=2&viewability=78&renderer=1&be=0&rtime=34.0&adj0=0.0&tmax=300&s_ip=74.125.78.130&adj2=0.0&adj1=0.0&adtypes=0&mx_aabpc=0&reqid=YsiQ5gACcHwKh7MHKwvEgQ&sc=IL&sd=1&mowxReqId=801d847da7dc4377ada544c2e5214403_1&ifdp=0&requrl=https%3A%2F%2Fxmod.in%2Fblog&bidrestime=1657311462222&pv_adtype=0&cc=US&strg=HARMONY&cxtSgmt=segment_broad_technology_computing&pcrid=8CU5RJ1PV-845116586-28-18&coppa_enf=true&sc_prspt=headerBid&bdp=0.510&ct=Chicago&spIsReq=3&s=1&abs=0%7C0%7Cxtmax%3D290%7CHARMONY%7Cbrr%3D0&mx_epbc=8CU5RJ1PV&dnt_enf=false&mx_ssBucket=0&vls=0&asn=16276&mang=1&sc_cbdp=0.020&fleet=appnexus&mx_isLossNtf=false&advUrl=https%3A%2F%2Fsearch.yahoo.com&dn=xmod.in&pgcatiab2=628&dt=O&acid=801d847da7dc4377ada544c2e5214403&actltime=44&act=headerBid&iframingState=0&mx_lr_seg_deal=0&exclattr=32%7C34%7C70%7C13%7C14%7C15%7C48%7C16%7C17%7C114%7C18%7C19%7C20%7C22%7C25%7C26%7C27%7C30&dfpBd=0.347&sckfl=1&dmm_erpm=true&mx_lr=0&mview=1&smbrid=adx-unknown&bfs=103&rfc=-1&prvApiId=8CU5RJ1PV&epcexp=false&pubid=pub-ADX-116310109131&mx_bsProfile=0&cid=8CUU9JF8H&bcrid=1700080800126500300025000001000&omul=1.0&res_mtype=0&apPrfs%3C%3E=60%23%2315%23%2313%23%2310&suid=CAESEEDbbBwOYugU9XTgTDofEwM&chnl=HARMONY&pst=0&reqsize=300x250&adpos=1&itype=ADX&mx_g_one_uid_sent=None&spCst=0&tgtval=pub-ADX-116310109131&__expireat=1657312062477&lmt_status=N&reftype=3&viewability_vendor=EXCHANGE&prvAccId=845116586&ckfl=0&lper=1&mx_tgs=300x250&cbdp=0.347&sc_advUrl=https%3A%2F%2Ftopics.businessfocus.online&pvdTmax=248&ltime=42.0&epc=845116586&ctr_vendor=EXCHANGE&prvReqId=118135143865769_47895406_11621109112941&zip=60641&exid=31&spFst=0&mx_GCID=0&cliIPType=v4&pexid=ADX-pub-8676560598296682&ybnca_erpm=0.51&brsrclk=0&sbdrid=186&rtttime=55&apTags%3C%3E=75&mx_PC=1&wsip=mowx-lite-7776598566-8cnh2&currsrc_date=2022-07-08+00%3A00%3A00&sc_adj0=0.0&sc_adj1=0.0&sc_adj2=0.0&psrc=fail&geoll=false&debug_ts=2022-07-08+20%3A17%3A42&policy_enf=2&mx_ssProfile=0&mx_SC=0&reftime=60&pbidflr=0.010&spbf=0&currsrc=API&fpusp=false&lmt_applied=N&mnrfc=-1&pub_blk_enf=1&amptype=1&moau=true&ocurr=USD&snm=SUCCESS&mx_IAB2=1&usp_enf=1&bidflr=0.010&sc_ogbdp=0.02&incentive_type=0&skadidfl=0&pid=8PR113JGC&spTo=3&pvid=294&schain_cmpl=0&is_ortb=false&mx_aurl_hc=0&ucrid_ver=2&mx_maq_call=false&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=1&dbf=1&gdpr=0&gqid=AADH9t9am_notI4YjOLVdbQu6JvHv-pesAdNTqmN_jQ8dSgBkVUr85ZJ9PGJODW-NMxp_wX_&dmm_ogerpm=false&csip=rtb-appnexus-7cfb9985db-b5t6w.SC&mx_bsBucket=0&mx_aurt=0&spIvt=3&ptype=23&media=0&smsrc=1&acsn=1&dtc=east_sc&mx_aqcpl_crid=4&ogbdp=0.51&tpbTkn=false&adblk=527204189&fpuReq=1&vcmplrt=-1.0&crid=116211091&geo_source=2&sat=1&mnet_ckfl=0&mp_seg%3C%3E=44632%23%2360149%23%2344652%23%2344661%23%2344629%23%2361058%23%237688%23%2355664%23%2352765%23%2343988%23%237708%23%2317191%23%237717%23%237685&sc_pvid=319&opbidflr=0.010&impId=1&rme=adm&bdata=sd2%3Dnull~iurl_l%3D20~ogerpm%3D0.51~vis_sd%3D199~url_rps_b%3D6.43~dom_b%3D1~dc2%3D1~scd%3Dqc~v_asn%3D16276~dom_l%3D20~vl2r_sd%3D2022070808~iurl_b%3D717.11~url_tkc%3D9~url_r2a_b%3D0~std%3D~MP%3D.*blog.*~last%3D~vis_url_b%3D0.54~ip%3D2Jqus0~fbb%3D0~vis_url_l%3D30~riipua%3D0%2C0~et%3D33~rc%3D3%2C833~risuid%3D0%2C0~rps_sd%3D2022070813~vis_b%3D580.26~url_b%3D1.39~vl2r_url_b%3D0.02~vl2r_url_vi%3D470~url_tvi%3D466~url_l%3D20~gcat%3D501022~bb%3D186~vv%3D0~cvl2r_sd%3D196~l2r_b%3D1000~erpm%3D0.51~vl2r_url_kc%3D1E1~vl2r_up_l%3D20~bm%3D1~sid%3D845116586~sd%3D1~uid%3Dh8gqLgMIbUNt4LbXL~url_rps_kc%3D1~cvl2r_b%3D3.12~btd%3D942853204152420225907503496055017809800011412901055793140095662623681771212800~cvl2%3D19.72~3pcf%3D1000.31~uim%3D0~dmm_strg%3Dharmony~vl2r_up_b%3D0.02~ss%3DNA~uiw%3D-1~ce%3D0~rps_b%3D135.87~url_srps_b%3D18.34~CI%3D2702~nts%3D1~MP2%3D.*blog.*~tb%3D-1~ct%3Dmontreal~basis2%3D196~basis1%3D196~isRef%3D0~PF%3D0~isif%3D0~lc%3D1~url_rpc_b%3D0~bid%3D0.51~dc%3D8~url_rps_rv%3D0~vl2r_b%3D6.42~supply_tag_id%3D%7Eviewability%3D0.78%7Eamp%3D1%7Ecbdp%3D0.510%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3D%7Ehtml%3D1%7Eadblk%3D527204189%7Esobp%3D0.02%7Ectr%3D0.0016823688%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D0.510%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D527204189%7Edetected_tag_id%3D%7Edcut%3D30%7Edogb%3D0-1~ibc%3D1~ddt%3D-1~nsz%3D1~tgs%3D300x250~bsb%3D0~bsp%3D0~tmx%3D248&utime=1160&sf=0&cpr=0.32419518061527874
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: max-age=3600
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Apache
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=21600
content-length: 35
expires: Sat, 09 Jul 2022 02:17:43 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E796 22 KB
8 KB 20ms
19ms Document
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 92723
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Jul 2022 18:32:20 GMT
expires: Fri, 07 Jul 2023 18:32:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 602A 42 B
64 B 87ms
42ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunT3ikvrGS8oYbhbjf5I2Hz2R4WzvlwbL8fF8e4fIpufKeYnUVFaH6oNfm0bzAtlj2oGxq_Rjr-dQFFbs7EYA1vu9Lz7L6WhGE8CBSbLMA0BGxp7f7ykJoIpb6VXUPF-_CcFY&sai=AMfl-YQ1vqXHoxbmGjDOISvxnDt4HRPWGpzIPJ3ZBq7kfpwO1ftGK0Wu21oa3DL8Td5DcxDiT1PdfV2-kYwYmmke38JKJd49gQCIz8SUsW_3wHxXr3j0A1-Q0VHGcZ3W&sig=Cg0ArKJSzNZzyVm5ygSNEAE&cid=CAASJeRoDMi--XWTmmpp8WIRuNF_BcLH99O3Ty_96HyxZ77VMzSTvg4&id=lidar2&mcvt=1151&p=538,650,788,950&mtos=1151,1151,1151,1151,1151&tos=1151,0,0,0,0&v=20220706&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3331753794&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1657311461576&rpt=653&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK GS.d Show response
js.cookieless-data.com/ Frame B02B 0
535 B 182ms
182ms Script
text/plain 51.158.29.13
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.158.29.13 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

Software

nginx/1.20.2 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains; preload
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx/1.20.2
Strict-Transport-Security: max-age=15724800; includeSubDomains; preload
P3p: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 0
X-Xss-Protection: 0
Expires: Tue, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 9FAE 2 KB
814 B 11ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2bb78272a859ca6

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 204
No Content pbsync
usermatch.targeting.unrulymedia.com/ Frame CF60 0
0 24ms
24ms Document
text/plain 199.127.204.147
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=${GDPR}&consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&rurl=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 199.127.204.147 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Tengine

GET
H3 200 PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js Show response
pagead2.googlesyndication.com/bg/ Frame AD16 36 KB
14 KB 20ms
19ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c12f2da086c2408f3f1255b457b7798f793cf77f792c14c66fdbb9bf3c3eaa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 19:02:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 177329
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13888
x-xss-protection: 0
last-modified: Fri, 01 Jul 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 06 Jul 2023 19:02:14 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 79C8 15 B
216 B 27ms
27ms Script
text/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=5194&&&vgd_l2type=sca&fp=yzzAfwSZMQYDIuI3H0cMifOjuM6fa10xmptSGrGHiHCRmZJpDpwg-6iMEoe0xaQUGZBnWRO6lH1dJuw0QTepKe1tR98MOOAOa9nX89LHFH0EziI63W7sLlhZmSRraZrP&cme=YSQmVsL630xr75UvUGuUgSnNBi3gLF-iv288S1arm_23rYCiGpt3At9yRSrn_vkTZYGlFYBzJrnFF-qOTjGIQtp2I8PiGWyiCUIoZpkGcidnVIQSkurj-31FeubWDBOWhdhXUFRxhyfRnM2XHmKK6uTWMZzYzA4lTQN1ray_MU1GOVOctDw-lzgyffkp47dzU-OZr7l-3W-aQIjtvJvECcEwRnhu7mPsMkeRSUcUKes%3D%7C%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7CJwgYdc1KQkFA0AkMtcoUY9olDV92JfOo%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD6YYKAfSVuGWyUY6vyv8InEJ2xnHJ5H_0o%3D%7CdjcAzWUMxI6HP2khnRaO7mtEoja5gajc6kULwFPc0HMYfQYZfiE1r7ziXyTJhsxhQubCUvc0MRZgTsykJOgqfot3vdib5aR3ZrTOguqGn_P9hiVt_pA3vWulH2F__YdE2VW4KPPyHSpWa9aGdNIqgteImv2Tx_7Vu1PuU7nsHtwDbGtwGjgUEALRXaVc_L7sXt5E4Ix7PZ7bPNwr-bKciv670fGSoOoZ7bTWOOx91EWvCjQB7-t2lrOc32vrQlS4CaVpedot5sc%3D%7C&v=1&geo=45.5%7C-73.58&lper=100&lpid=&tsid=4&q=&prv=&type=&ps=&hint=&td=&cc=CA&wsip=170722258&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nfu&vgd_fm_lang=EN&vgd_dnquo=00_XX&ksu=224&fdkt=374&vgde_kbbh=fuoyxQBuG&kwd[]=WordPress+Hosting+Services&kwt[]=374&kbc[]=156583&kwp[]=1&kid[]=316611362&kbc2[]=5%3D9187%7C6%3D2%7C16%3D8%7Co_r%3D0.25%7Cp_r%3D0.17%7Cl_r%3D42%7Cc%3D-127%7C17%3D3.66%7C18%3D-1%7C19%3D7.80%7C1%3D0.57%7C2%3D6.65%7C3%3D1.32%7C4%3D1.29&ktd[]=1126174801527296&kwd[]=10+Best+Auto+Insurance+Rates&kwt[]=267&kbc[]=56840&kwp[]=2&kid[]=330067967&kbc2[]=56840%7C%7C%7Co_r%3D0.33%7Cp_r%3D0.25%7Cl_r%3D138%7Cc%3D440%7C17%3D4.57%7C18%3D-1%7C19%3D5.25%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C1%3D3.44%7C2%3D13.58%7Cps%3D0.794%7C3%3D0.74%7C4%3D1.00&ktd[]=274894881536&kwd[]=Watch+Live+Online&kwt[]=374&kbc[]=250055&kwp[]=3&kid[]=180959746&kbc2[]=5%3D3266%7C6%3D3%7C16%3D8%7Co_r%3D0.38%7Cp_r%3D0.47%7Cl_r%3D44%7Cc%3D879%7C17%3D8.81%7C18%3D-1%7C19%3D4.08%7C1%3D0.24%7C2%3D2.02%7C3%3D0.27%7C4%3D3.74&ktd[]=1126174818304512&kwd[]=Top+3+Stocks+to+Buy&kwt[]=375&kbc[]=32871&kwp[]=4&kid[]=321206339&kbc2[]=%23c%3A3473961%7Co_r%3D0.13%7Cp_r%3D0.20%7Cl_r%3D46%7Cc%3D9%7C17%3D2.69%7C18%3D-1%7C19%3D3.27%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C1%3D0.48%7C2%3D3.65%7Cps%3D0.976%7C3%3D1.11%7C4%3D4.17&ktd[]=1126174818304768&cid=8CU5RJ1PV&vwid=1657311462524544321&vi=1657311462524544321&tdAdd[]=ib%3D0&vsid=3003130611454751&tdAdd[]=asnum%3D16276&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_l3_sc=QC&vgd_chost=contextual.media.net&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_katbid=-21&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_kals=ttype%3D10019%7C%7Cpc%3D7%7C%7Cfat%3D1&vgd_kalog=UUID%3Dh8qAYJcEiHxNHTtWE%7C%7CMPTD%3D128%7C%7CSID%3D8%7C%7CTLID%3D6%7C%7CMI%3D2750%7C%7CHID%3D2%7C%7CCI%3D2750%7C%7CTPTD%3D565939267609604%7C%7CSI%3D2750&vgd_katid=808128972&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170722258&vgd_nrrv=54023&vgd_nrrmf=4848&vgd_nrrsf=scrr&vgd_cty=montreal&vgd_go_pid=8POPGE52H&&vgd_ifrmode=14&vgd_l1rakh=1657311462167061077&sttm=1657311462608&upk=1657311463.14622&hvsid=00001657311462608025035145474926&verid=3111299&vgd_matchstr=hr%3D0%7C&sbdrId=196&vgd_vsidtv=000V10&vgd_ecrid=1700080812897200728009000001000&vgd_isiolc=1&vgd_fcm_enc_mis=1&&kbbq=%26asn%3D16276&&vgd_vstrid=3003130611454751&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.uX~e8QMQOvuii~xLjMLEQMGvi.fF~OmYMGvu~ONfvu~QNOv%20N~eM1QzvuFfhF~OmYMjvf9~ejfLMQOvf9ff9h9W9W~8xLjMGvhuh.uu~xLjM7UNv9~xLjMLf1MGv9~Q7Ov~c0v.*Gjmy.*~j1Q7v~e8QMxLjMGv9.AX~8Evf6%20xQ9~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vfW~LNvA%2Cuhh~L8Qx8Ov9%2C9~LEQMQOvf9ff9h9WuA~e8QMGvAuf.HA~xLjMGvf.HW~ejfLMxLjMGv9~ejfLMxLjMe8vu49~xLjM7e8vHi~xLjMjvu9~yN17vX9u9ff~GGvuiF~eev9~NejfLMQOvuiF~jfLMGvu999~JLEYv9.uX~ejfLMxLjMUNv949~ejfLMxEMjvf9~GYvu~Q8OvhFHhfHiFh~QOvf~x8OvwWyEJAkWUTXlPger3~xLjMLEQMUNv9~NejfLMGvu.ih~G7OvuuhHHAhAWfFfh9XfFuFhXHFXHFFu9HXFAWWf9WAihffWWA9AiffuhAfAFFXhWuifFHAiHAFXhuuXFHW~Nejfvu.iA~AENkvu99u.hu~x8Yv9~OYYMQ7Lyvw1LYmz5~ejfLMxEMGv9~QQvIK~x8Bvou~NJv9~LEQMGvuu9.Wf~xLjMQLEQMGvui.9i~%3DVvfh9f~z7Qvu~c0fv.*Gjmy.*~7Gvou~N7vYmz7LJ1j~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~0sv9~8Q8kv9~jNvu~xLjMLENMGv9~G8Ov9.uX~ONvW~xLjMLEQMLev9~ejfLMGvH.u~QxEEj5M71yM8Ov~e8JB1G8j875v9.Xu~1YEvu~NGOEv9.uX9~OYYvw1LYmz5~Qx8Ov%3DK4b44rGGRBa3xyPit_y_rmk4Bc~QyY7vQJyYJz7MGLm1OM7JNwzmjmy5MNmYEx78zy~QOvf~O7NvJ1Q7MQN~-8OvKrtoExGoWFhFXF9XiWfiFFWf~O1jyv~w7Yjvu~1OGjUvhH9iXWiA9~QmGEv~N7Lv9.9~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.9u9~myG8Ov9.uX9~1NM75EJvu~875EJM8Ovuh~QJjjJLM71yM8Ov~1OMGjUMUJ5vhH9iXWiA9~OJ7JN7JOM71yM8Ov~ONx7vA9~OmyGv9ou~8GNvu~OO7vou~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfHW&vgd_optout=0&vgd_cfud=220628&vgd_scsver=258&vgd_go_ent=1&vgd_rensize=728_90&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_dtc=east_sc&vgd_mbr=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A728%3Brend_h%3A90&&vgd_uspa=0&vgd_sc=QC&vgd_l1rhst=contextual.media.net&hvsid=00001657311462608025035145474926&subBdr=196&bdrid=294&rc=0&rand=1657311463316&acid=00fd9a5a68c5437cb1f7f84b94aaa1f2&matm=1657311463316&vgd_ltimesrc=1&vgd_ltime=1341&vgd_rtime=1191&vgd_etm=15&vgd_l1hcsd=O6005%7C4504&vgd_tcf_cmp=1&vgd_l1ch=1&vgd_lhl=2898&vgd_pgid=p1947862235t202207082017&vgd_adprefflag=10&vgd_adpref_diff=100&vgd_csip=rtb-appnexus-7cfb9985db-885jb.SC&vgd_sbSup=1&vgd_vsidv=10&vgd_nrrs=54023&vgd_cntrdt=SF%7Cb97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TV51ISA&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311462524544321&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4B&bcpf=8fOnRrolnfOur8B4zx%2FBge4B&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808128972&kapc=7&ekals=775EJvu99ui%7C%7CENvh%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

49.246.178.107.bc.googleusercontent.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:43 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FE6E
Redirect Chain

https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=mS-kh5YtoouCfv6MmyzqiJcu_o6CJf7dmy-XBHqL

43 B
910 B

52ms
49ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=mS-kh5YtoouCfv6MmyzqiJcu_o6CJf7dmy-XBHqL
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8147efeba23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BlJnHKDmXTjthJrW%2Bf4Y3f0pswG1Ct6wlsyOkR5a%2BZ1%2B%2F3sjcXnHIow5SIWbQaqwu%2Bw165d6LwE8QdZPiaAuS0ogIO0YoDRj1CuVeoxGnam8nPYZiRMgxFQFn4DV%2FS0yrxlWslo2yG%2Bp3w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=mS-kh5YtoouCfv6MmyzqiJcu_o6CJf7dmy-XBHqL
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE6E
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=472EAFCEE13948B5AAD5A88A32E34BD1

43 B
907 B

58ms
55ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=472EAFCEE13948B5AAD5A88A32E34BD1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8147efeda23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RlGMtgQKFpEhEipK4kvAJ80VCzeSbLujZkS7vzk584YHWt%2BI1gY40Y0BeP6UTiFgO7qG7hstzpnhfUQHeOi2%2BrsUyG5R4adkcHxoLmnWo%2B8JCgM8%2FEMeSUNjI7YO0R41fx8WVUqqDjGFPg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
server: nginx
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=472EAFCEE13948B5AAD5A88A32E34BD1
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 07 Jul 2022 20:17:43 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE6E
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=7517899671563583421&expiration=1658521063

43 B
903 B

59ms
59ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=7517899671563583421&expiration=1658521063
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b814878a1a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2DYudDxvHBLU1e2GpQvZn9smU0UAnQTH%2BaeaGd9JlGFoeegSKGIW3llzC0jBaobxkJ071mcXxsDAh5N6kvFjLelnwdtz7wZFCKso7MTcCv0UejBpoJ5nYOCYEkkpR8kPHCImgiso48zYSw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=7517899671563583421&expiration=1658521063
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE6E
Redirect Chain

https://d.adroll.com/cm/index/ssp
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0

43 B
909 B

68ms
66ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81492971a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SXlIrBaEWt0H8zayevhmNQT0yxRsWP%2BC45VcfzL8OX%2FUtDlU2JmBUjPeqxRThLjEvRLnwMX%2BvYcorPYY9pkJwuuPWVehnoPA94Jx6ICnE%2BeJ%2BaPoRqPigAgRqqp43BwtOdeCuUgv01VUtg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx/1.20.0
content-length: 76

GET
H2

200

YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame FE6E
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB

43 B
993 B

29ms
28ms

Image
image/gif

2600:1f18:4e9:5a02:357b:502f:f800:1eb
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D

Protocol

Server

2600:1f18:4e9:5a02:357b:502f:f800:1eb Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
date: Fri, 08 Jul 2022 20:17:43 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE6E
Redirect Chain

https://px.owneriq.net/eucm/p/cc?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D31%26external_user_id%3D(OIQ_UUID)
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=31&external_user_id=Q7105978601712531473

43 B
907 B

63ms
62ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=31&external_user_id=Q7105978601712531473
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b814878c6a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DF8TeskgXnnDtHL7u2J7Khg1MIp1rESVmq4%2BgQX2G6zdXuLwR67GqDzyyu3DpLsRmCBm8nU7%2Fie78JW%2FcNmo45VhZ78Oc9xaPjTBNbpEvdnKU6JsrPRhYDz83EgWMCJyHVLZOGajR0oX8g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=31&external_user_id=Q7105978601712531473
Cache-Control: max-age=50756
Connection: keep-alive
Content-Type: text/html
Content-Length: 154

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FE6E
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=12f6281c-b70c-4521-a5d1-738348ad6a8e-tuct9c21667

43 B
914 B

56ms
56ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=12f6281c-b70c-4521-a5d1-738348ad6a8e-tuct9c21667
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8148c929a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yS1jqunS6CXbYJ8%2BKZ%2BsVuJ9A%2FmbDEd658f4A1R3j6KFkpt%2BlajRILnSzA5mHCiJ7ZGa4Z90k2oQu%2Biq%2FChm2OXTRPcdLIbpi%2B6%2B4Ki6SJcu4lDU8vgcM74eUJNmkiw%2Foen4zHy0rKq5HA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=12f6281c-b70c-4521-a5d1-738348ad6a8e-tuct9c21667
date: Fri, 08 Jul 2022 20:17:43 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 17194

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE6E
Redirect Chain

https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07de22040745beb95401c3e6&expiration=[EXPIRATION]

43 B
906 B

64ms
64ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07de22040745beb95401c3e6&expiration=[EXPIRATION]
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81553e18a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KqpWMrnSNvaSooS6MTrq7Q3B2OmqE68P1R2VOCA0q34kFli3ccSjYxXPvMipIp%2B2pOxwHc5sNI4A9Xc%2BHuesS3hg5qAoDWZIb66rGuUEAXcHA9YiVa2QG2Bt3kmEVYzaLLsOuSGu%2FIZ1pw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07de22040745beb95401c3e6&expiration=[EXPIRATION]
Date: Fri, 08 Jul 2022 20:17:21 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Powered-By: Express
Content-Length: 0
Vary: Origin

GET
H3 204 1
sync.connectad.io/umatch/ Frame FE6E 0
799 B 130ms
127ms Image
text/plain 2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.connectad.io/umatch/1?bidder=idx&dataid=data13&uuid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-ray: 727b8147b8df7136-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200 ptrack Show response
a.audrte.com/ Frame 339A 368 B
880 B 88ms
75ms XHR
text/plain 54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptrack?arlocation=149.56.153.179&p=M1353665098&artime=2022-07-08T20:17:43.505Z&arlocation=YWRzLnVzLmUtcGxhbm5pbmcubmV0L3VzcGQvMT9jdD0xJmR1PWh0dHBzJTNBJTJGJTJGc3luYy5hZHRlbGxpZ2VudC5jb20lMkZjc3luYyUzRnQlM0RhJTI2ZXAlM0QzMDc5NzElMjZleHR1aWQlM0QlMjRVSUQ=&gdpr=0&gdpr_consent=null&gdpr_version=1&arreferer=eG1vZC5pbi8=
Requested by: Host: a.audrte.com
URL: https://a.audrte.com/ptag?p=M1353665098
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 150135ffe13d6ccde474c534aa917b661499daed11c88447732a4c43414086b2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: https://ads.us.e-planning.net
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 263

GET
H2 200 optimus_rules.json Show response
tags.crwdcntrl.net/lt/c/15238/ Frame 339A 155 B
629 B 97ms
52ms XHR
application/json 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/15238/optimus_rules.json
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1b92260a400bea230772ccfff1953fbe65deeb30da1a8aa146342d20833f24ff

Request headers

Referer: https://ads.us.e-planning.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 08 Jul 2022 19:04:02 GMT
via: 1.1 c3e66686bc7ab6e675ee9210e15097b6.cloudfront.net (CloudFront)
age: 4422
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 155
last-modified: Wed, 15 Jun 2022 17:05:13 GMT
server: AmazonS3
etag: "1a1722e9cedbdc8af0dcd3345e46c73a"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: max-age: 86400
x-amz-cf-pop: JFK50-P4
accept-ranges: bytes
x-amz-cf-id: EHncMZieXm5uhcXf5Q8w5RwZlsRqThlZmLcZccirFgws64QCkoyHVA==

GET
H3 204 1
sync.connectad.io/umatch/ Frame 0C09 0
799 B 129ms
119ms Image
text/plain 2606:4700:10::6816:36ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.connectad.io/umatch/1?dataid=data5&uuid=837a3169-7e60-066c-2a47-31c1bb4ec1bd
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cache-control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-ray: 727b81471ffb7136-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0C09
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=

43 B
61 B

45ms
44ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:42 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 0C09 95 B
113 B 42ms
38ms Image
image/png 107.178.246.49
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=bcdacd5a-9cf8-0802-0b2a-69020999c23c

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D

Protocol

Security

QUIC, , AES_128_GCM

Server

107.178.246.49 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58294/ Frame 0C09 0
168 B 31ms
26ms Image
text/plain 3.218.90.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=94603d2f-1f95-0fcc-12ec-30deadb6f759

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-90-66.compute-1.amazonaws.com

Software

ATS/9.1.0.46 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: ATS/9.1.0.46
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 0C09
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
https://id.rlcdn.com/464246.gif?partner_uid=ef62c1c0-0ab8-03e5-1eb2-7127038e62e8
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=ef62c1c0-0ab8-03e5-1eb2-7127038e62e8

42 B
60 B

44ms
43ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=ef62c1c0-0ab8-03e5-1eb2-7127038e62e8
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Fri, 08 Jul 2022 20:17:43 GMT
content-encoding: gzip
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=ef62c1c0-0ab8-03e5-1eb2-7127038e62e8
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0C09
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=2840070346914927031

43 B
61 B

40ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=2840070346914927031
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4fce191f-1439-44f0-aea7-fcda1dc8544d
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 0C09 43 B
932 B 35ms
31ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e272c2db-db55-8e7f-81c5-73435226c8d0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: R8DK0H9YBY20WRAGPT3V
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B54C 1 KB
753 B 26ms
20ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3337
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DCF8 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7eb38d9bacc6da3bd11298847b3f837a067a9594deda383c2673267bf5c4f829

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E1D0 6 KB
3 KB 19ms
18ms Document
text/html 2607:f8b0:4006:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022063001.js?cb=31068337

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:40 GMT
expires: Sat, 08 Jul 2023 20:17:40 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 smtr Show response
contextual.media.net/ Frame 9DB8 65 KB
27 KB 221ms
220ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T5KC7JQ&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463845468988&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=B4zx%2FB8fOnRrolnfOur8ge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058573&kapc=18&ekals=775EJvu99ui%7C%7CENvuW%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU5RJ1PV

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

4a4e17c845806c2666b23eb74e460af2a00a77fe62617e84361987998a3b63d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 27208
content-type: text/html
date: Fri, 08 Jul 2022 20:17:43 GMT
expires: Fri, 08 Jul 2022 20:17:43 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-sc-h: 21-sbsf
x-sc-w: 21-3254

GET
H2 200 bping.php
lg3.media.net/ Frame E9F5 35 B
189 B 32ms
31ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=531&&gdpr=0&prid=8PRN625DH&cid=8CU5RJ1PV&crid=764724967&vi=1657311463845468988&ugd=4&lf=6&cc=CA&sc=QC&vsid=3003130611454751&lper=100&wsip=2886781036&r=1657311463580&requrl=https%3A%2F%2Fxmod.in%2Fblog&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=16276&vgd_rakh=1657311463133227333&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_pgid=p1947862235t202207082017&vgd_pgids=1&vgd_uspa=0&hvsid=00001657311463578025035145478352&gdpr=0&vgd_end=1

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:43 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame E072
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&us_privacy=1---&khaos=L5CWGBJG-1Y-B9H5
https://ssc-cms.33across.com/ps/?xi=1&xu=L5CWGBJG-1Y-B9H5
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=L5CWGBJG-1Y-B9H5&ts=1657311463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

31ms
30ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=L5CWGBJG-1Y-B9H5&ts=1657311463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=656378
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=L5CWGBJG-1Y-B9H5&ts=1657311463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame B871 26 KB
9 KB 36ms
34ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

4a34cf7a580b600dbbba734ec62fcb28f479657a859944722e1b1e99ff42e4da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 9326
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:43 GMT
expires: Sun, 10 Jul 2022 20:17:43 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 clog
hblg.media.net/ Frame E9F5 35 B
172 B 21ms
19ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/clog?logid=awlog&pixel_len_bucket=4901&lmt_enf=true&req_mtype%3C%3E=0&mx_nsz=1&spSource=0&ifst=0&vid=YsiQ5gAFc1wKh-eNngTbdA&s_city=charleston&ugd=4&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D2%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1%7Ctpi%3D1&app=0&ctr=5.1813474E-4&mx_TAF=2&sc_bdp=0.010&device_id=4&ae=false&mx_UCC=4&prspt=headerBid&mx_bss_algos%3C%3E=0&usp_status=0&seat=BID_API&og_cbdp=0.320&size=728x90&mx_TAS=1&mx_gpid_sent=false&xtmax=290&commit_id=6ac920ad&scrid=1700080805857300728009000001000&itypeid=17&mx_SPRIG=2&viewability=90&renderer=0&be=0&rtime=38.0&adj0=0.0&tmax=300&s_ip=74.125.78.129&adj2=0.0&adj1=0.0&adtypes=0&mx_aabpc=0&reqid=YsiQ5gAFc1wKh-eNngTbdA&sc=IL&sd=1&mowxReqId=a5902f4ddc86467d8171c7bce5cb1909_1&ifdp=0&requrl=https%3A%2F%2Fxmod.in%2Fblog&bidrestime=1657311462422&pv_adtype=0&cc=US&strg=HARMONY&cxtSgmt=segment_broad_technology_computing&pcrid=8CU5RJ1PV-764724967-28-8&coppa_enf=true&sc_prspt=headerBid&bdp=0.320&ct=Chicago&spIsReq=3&s=1&abs=0%7C0%7Cxtmax%3D290%7CHARMONY%7Cbrr%3D0&mx_epbc=8CU5RJ1PV&dnt_enf=false&mx_ssBucket=0&vls=0&asn=16276&mang=1&sc_cbdp=0.010&fleet=appnexus&mx_isLossNtf=false&advUrl=https%3A%2F%2Fsearch.yahoo.com&dn=xmod.in&pgcatiab2=628&dt=O&acid=a5902f4ddc86467d8171c7bce5cb1909&actltime=46&act=headerBid&iframingState=0&mx_lr_seg_deal=0&exclattr=32%7C34%7C70%7C13%7C14%7C15%7C48%7C16%7C17%7C18%7C114%7C19%7C20%7C22%7C25%7C26%7C27&dfpBd=0.218&sckfl=1&dmm_erpm=true&mx_lr=0&mview=1&smbrid=adx-unknown&bfs=103&rfc=-1&prvApiId=8CU5RJ1PV&epcexp=false&pubid=pub-ADX-116310109131&mx_bsProfile=0&cid=8CUU9JF8H&bcrid=1700080805857300728009000001000&omul=1.0&res_mtype=0&apPrfs%3C%3E=60%23%2315%23%2313%23%2310&suid=CAESEEDbbBwOYugU9XTgTDofEwM&chnl=HARMONY&pst=0&reqsize=728x90&adpos=1&itype=ADX&mx_g_one_uid_sent=None&spCst=0&tgtval=pub-ADX-116310109131&__expireat=1657312062677&lmt_status=N&reftype=3&viewability_vendor=EXCHANGE&prvAccId=764724967&ckfl=0&lper=1&mx_tgs=728x90&cbdp=0.218&sc_advUrl=https%3A%2F%2Ftopics.businessfocus.online&pvdTmax=247&ltime=45.0&epc=764724967&ctr_vendor=EXCHANGE&prvReqId=28894217709805_720695613_11621109112941&zip=60641&exid=31&spFst=0&mx_GCID=0&cliIPType=v4&pexid=ADX-pub-8676560598296682&ybnca_erpm=0.32&brsrclk=0&sbdrid=196&rtttime=58&apTags%3C%3E=75&mx_PC=1&wsip=mowx-lite-7776598566-t6sss&currsrc_date=2022-07-08+00%3A00%3A00&sc_adj0=0.0&sc_adj1=0.0&sc_adj2=0.0&psrc=fail&geoll=false&debug_ts=2022-07-08+20%3A17%3A42&policy_enf=2&mx_ssProfile=0&mx_SC=0&reftime=60&pbidflr=0.010&spbf=0&currsrc=API&fpusp=false&lmt_applied=N&mnrfc=-1&pub_blk_enf=1&amptype=1&moau=true&ocurr=USD&snm=SUCCESS&mx_IAB2=1&usp_enf=1&bidflr=0.010&sc_ogbdp=0.01&incentive_type=0&skadidfl=0&pid=8PR113JGC&spTo=3&pvid=294&schain_cmpl=0&is_ortb=false&mx_aurl_hc=0&ucrid_ver=2&mx_maq_call=false&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=1&dbf=1&gdpr=0&gqid=AADH9t_R8DK6tntp5NUMMFNafRBBFSX1-SsNhEYxqUu3--oPppDQqC2J24LhU5nCu_AR05Oo&dmm_ogerpm=false&csip=rtb-appnexus-7cfb9985db-74jlf.SC&mx_bsBucket=0&mx_aurt=0&spIvt=3&ptype=23&media=0&smsrc=1&acsn=1&dtc=east_sc&mx_aqcpl_crid=4&ogbdp=0.32&tpbTkn=false&adblk=1220607417&fpuReq=1&vcmplrt=-1.0&crid=116211091&geo_source=2&sat=1&mnet_ckfl=0&mp_seg%3C%3E=44632%23%2360149%23%2344652%23%2344661%23%2344629%23%2361058%23%237688%23%2355664%23%2352765%23%2343988%23%237708%23%2317191%23%237717%23%237685&sc_pvid=319&opbidflr=0.010&impId=1&rme=adm&bdata=sd2%3Dnull~iurl_l%3D20~ogerpm%3D0.32~vis_sd%3D199~url_rps_b%3D9.26~dom_b%3D1~dc2%3D1~scd%3Dqc~v_asn%3D16276~dom_l%3D20~vl2r_sd%3D2022070808~iurl_b%3D717.11~url_tkc%3D0~url_r2a_b%3D0~std%3D~MP%3D.*blog.*~last%3D~vis_url_b%3D0.35~ip%3D2Jqus0~fbb%3D0~vis_url_l%3D30~riipua%3D0%2C0~et%3D37~rc%3D4%2C819~risuid%3D0%2C0~rps_sd%3D2022070813~vis_b%3D761.08~url_b%3D2.48~vl2r_url_b%3D0~vl2r_url_vi%3D1E0~url_tvi%3D49~url_l%3D10~gcat%3D501022~bb%3D196~vv%3D0~cvl2r_sd%3D196~l2r_b%3D1000~erpm%3D0.32~vl2r_url_kc%3D0E0~vl2r_up_l%3D20~bm%3D1~sid%3D764724967~sd%3D1~uid%3Dh8gpPK3SOQe0Ib4F1~url_rps_kc%3D0~cvl2r_b%3D1.97~btd%3D1174437382627052616754654661045638820839722883039221732366578192643943657115648~cvl2%3D1.93~3pcf%3D1001.71~uim%3D0~dmm_strg%3Dharmony~vl2r_up_b%3D0~ss%3DNA~uiw%3D-1~ce%3D0~rps_b%3D110.82~url_srps_b%3D19.09~CI%3D2702~nts%3D1~MP2%3D.*blog.*~tb%3D-1~ct%3Dmontreal~basis2%3D196~basis1%3D196~isRef%3D0~PF%3D0~isif%3D0~lc%3D1~url_rpc_b%3D0~bid%3D0.32~dc%3D8~url_rps_rv%3D0~vl2r_b%3D3.74~supply_tag_id%3D%7Eviewability%3D0.9%7Eamp%3D1%7Ecbdp%3D0.320%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3D%7Ehtml%3D1%7Eadblk%3D1220607417%7Esobp%3D0.01%7Ectr%3D5.1813474E-4%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D0.320%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D1220607417%7Edetected_tag_id%3D%7Edcut%3D30%7Edogb%3D0-1~ibc%3D1~ddt%3D-1~nsz%3D1~tgs%3D728x90~bsb%3D0~bsp%3D0~tmx%3D247&utime=1252&sf=0&cpr=0.5147440962593164
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: max-age=3600
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Apache
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=21600
content-length: 35
expires: Sat, 09 Jul 2022 02:17:43 GMT

GET
H/1.1

200

p
a.audrte.com/ Frame 339A
Redirect Chain

https://dmp.adform.net/serving/cookie/match/?party=1003&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=7517899671563583421
https://a.audrte.com/p

68 B
617 B

27ms
26ms

Image
image/png

54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Protocol: HTTP/1.1
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

p
a.audrte.com/ Frame 339A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=&google_gid=CAESEHmWZqJfwGeylKuche3ULRQ&google_cver=1
https://a.audrte.com/p

68 B
617 B

34ms
27ms

Image
image/png

54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Protocol: HTTP/1.1
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/ Frame 339A
Redirect Chain

https://ps.eyeota.net/pixel?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
https://ps.eyeota.net/pixel/bounce/?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=

1 KB
1 KB

298ms
298ms

Image
application/javascript

52.55.144.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Content-Type: application/javascript
Content-Length: 1248
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /pixel/bounce/?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
Date: Fri, 08 Jul 2022 20:17:44 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 1E4C 312 B
609 B 19ms
19ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=43470173&p=156212&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 5621a57ab471a2a2c2420a4c1d70c3f2fa484e1dff7675fe3187dca48ba26a6c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:42 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 312
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDBD
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_cver=1&google_push=ARnp8GBvPPjjyfPhhIIJ-jMuZVLKsY8d7mK-ueloLNYmNFF0EqVZ-sv...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=631ed393dfd3122c&is_secure=true&networkId=14000&version=1&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_cver=1&google_push=ARnp8GBvPPjj...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGc64WYSPzeQMREc_UAAAAAAA&expiration=1657397863&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA...

170 B
188 B

37ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGc64WYSPzeQMREc_UAAAAAAA&expiration=1657397863&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_push=ARnp8GBvPPjjyfPhhIIJ-jMuZVLKsY8d7mK-ueloLNYmNFF0EqVZ-svlslJvxwunH8VSAEMSZzrmq2jvXOjvDodadtXJ83VqlhI

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGc64WYSPzeQMREc_UAAAAAAA&expiration=1657397863&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_push=ARnp8GBvPPjjyfPhhIIJ-jMuZVLKsY8d7mK-ueloLNYmNFF0EqVZ-svlslJvxwunH8VSAEMSZzrmq2jvXOjvDodadtXJ83VqlhI
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDBD
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESECixtGrEMKmDH3Mhlk8kzvk&google_cver=1&google_push=ARnp8GBGVP6xyW_XlNMAbpHOuMPQtxMUvRB4wQYS2UkMEZw77pY3-bV3EvzBWI9Qodmm4fg8ds6fYL7lAISNXOY3...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=vqBiyJDkTAC_d7PqqHDTBw&google_push=ARnp8GBGVP6xyW_XlNMAbpHOuMPQtxMUvRB4wQYS2UkMEZw77pY3-bV3EvzBWI9Qodmm4fg8ds6fYL7lAISNXOY3HEfQWvb_...

170 B
188 B

40ms
39ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=vqBiyJDkTAC_d7PqqHDTBw&google_push=ARnp8GBGVP6xyW_XlNMAbpHOuMPQtxMUvRB4wQYS2UkMEZw77pY3-bV3EvzBWI9Qodmm4fg8ds6fYL7lAISNXOY3HEfQWvb_a8oh

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x48 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=vqBiyJDkTAC_d7PqqHDTBw&google_push=ARnp8GBGVP6xyW_XlNMAbpHOuMPQtxMUvRB4wQYS2UkMEZw77pY3-bV3EvzBWI9Qodmm4fg8ds6fYL7lAISNXOY3HEfQWvb_a8oh
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:42 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDBD
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEJG19ih6vIbElKc0wSqMkp4&google_cver=1&google_push=ARnp8GCTG_6oULf6_0ziimtSZffiu5zi1wxhIghVFs-6PuLQUhNV0Obh-BYU14rqL_I4i4ufvqIqgLWsYzMQCe9d3C...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7

170 B
188 B

39ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDBD
Redirect Chain

https://c.us1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_push=%GOOGLE_PUSH%&cty=br&google_gid=CAESEMKlOZOZrPixtW6KAe2YVm4&google_cver=1&google_push=ARnp8GBG1dNRn57uk6_7i9h4jTZXw8y0numk0HSYjkObqATk7...
https://c.us1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_push=%GOOGLE_PUSH%&cty=br&google_gid=CAESEMKlOZOZrPixtW6KAe2YVm4&google_cver=1&google_push=ARnp8GBG1dNRn57uk6_7i9h4jTZXw8y0numk0HSYjkObqATk7...
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic_brazil&google_push=ARnp8GBG1dNRn57uk6_7i9h4jTZXw8y0numk0HSYjkObqATk7X8Lt2KQA6wzoHkb71PYaH0nEe0lzwEk62ESRxxcJxVuQB_aDFvH&google_hm=MDYwMzAwMDJf...

170 B
188 B

38ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dynadmic_brazil&google_push=ARnp8GBG1dNRn57uk6_7i9h4jTZXw8y0numk0HSYjkObqATk7X8Lt2KQA6wzoHkb71PYaH0nEe0lzwEk62ESRxxcJxVuQB_aDFvH&google_hm=MDYwMzAwMDJfNjJjODkwZTdjNjM4OA%3D%3D

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_nid=dynadmic_brazil&google_push=ARnp8GBG1dNRn57uk6_7i9h4jTZXw8y0numk0HSYjkObqATk7X8Lt2KQA6wzoHkb71PYaH0nEe0lzwEk62ESRxxcJxVuQB_aDFvH&google_hm=MDYwMzAwMDJfNjJjODkwZTdjNjM4OA%3D%3D
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDBD
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESENTZ7NK44Oq058aBIcuH-Ho&google_cver=1&google_push=ARnp8GA_ehhHAAhL-W8j4kB5TeCJKyxV_3nHpaqJouK7SpRFsAiNP451cQ8oZ4nnaBOBwABYCxAebQzfcdDQJ...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ARnp8GA_ehhHAAhL-W8j4kB5TeCJKyxV_3nHpaqJouK7SpRFsAiNP451cQ8oZ4nnaBOBwABYCxAebQzfcdDQJBY54VDENJuqvDb1&google_hm=amZ5Z0NaQXNYM19VUmJD...

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ARnp8GA_ehhHAAhL-W8j4kB5TeCJKyxV_3nHpaqJouK7SpRFsAiNP451cQ8oZ4nnaBOBwABYCxAebQzfcdDQJBY54VDENJuqvDb1&google_hm=amZ5Z0NaQXNYM19VUmJDVHlGVEI=

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
P3p: CP="We do not support P3P header."
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ARnp8GA_ehhHAAhL-W8j4kB5TeCJKyxV_3nHpaqJouK7SpRFsAiNP451cQ8oZ4nnaBOBwABYCxAebQzfcdDQJBY54VDENJuqvDb1&google_hm=amZ5Z0NaQXNYM19VUmJDVHlGVEI=
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDBD
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEOlfoPz4vNKRIjKCL1ef2-U&google_cver=1&google_push=ARnp8GDAhmiPy_kgvDx9x1d34wFUCqh3r4gA3k7LMtEQFtcer3R5mDkqElX5iuz3betgDbKxcGHNwLWUEjjYkHBc5GIUb1jS8Wu8
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ARnp8GDAhmiPy_kgvDx9x1d34wFUCqh3r4gA3k7LMtEQFtcer3R5mDkqElX5iuz3betgDbKxcGHNwLWUEjjYkHBc5GIUb1jS8Wu8&google_hm=ZzJhZjE3YTQyZTIzZTRi...

170 B
188 B

49ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ARnp8GDAhmiPy_kgvDx9x1d34wFUCqh3r4gA3k7LMtEQFtcer3R5mDkqElX5iuz3betgDbKxcGHNwLWUEjjYkHBc5GIUb1jS8Wu8&google_hm=ZzJhZjE3YTQyZTIzZTRiNzE3YzU=

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ARnp8GDAhmiPy_kgvDx9x1d34wFUCqh3r4gA3k7LMtEQFtcer3R5mDkqElX5iuz3betgDbKxcGHNwLWUEjjYkHBc5GIUb1jS8Wu8&google_hm=ZzJhZjE3YTQyZTIzZTRiNzE3YzU=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3 200 dot.gif
s0.2mdn.net/ Frame EDBD 43 B
65 B 37ms
34ms Image
image/gif 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEG1z8NM4vk5KEffsPkuEous&google_cver=1&google_push=ARnp8GA2BVYSFYe_Dr-K6-Km1lwQy6PK2iDeFAR08qLHXqe7CnkYKEMNiPyyDJM3tz-T18IBv58MwDIKnDTPYxZTRrvyV81Og5XK

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Jul 2022 20:17:43 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame EDBD 0
12 B 39ms
35ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kj2Gf0tXq6b-tNHyNwmOvOv0y-4p8pJYBpKoFT7CWNGti-JwkUn-4bVZbYwGr2wZtGHbEJaw

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B38F 1 KB
753 B 23ms
22ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3337
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E9F5 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cead5a38f0d06371b1d62fd76a312de484b62f2144988821ae7ed9b2063b72be

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 data Show response
bcp.crwdcntrl.net/6/ Frame 339A 142 B
1002 B 83ms
83ms XHR
application/json 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/data
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 20ed1f9c4106c46ab418b94d65337f13e49db7bc0fa7cb949ad95e6848ca23ec

Request headers

Referer: https://ads.us.e-planning.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://ads.us.e-planning.net
cache-control: no-cache
x-server: 10.40.7.231
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 142
expires: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E1D0 0
0 71ms
70ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C8Luj5pDIYpOjOoH4nwTwlqPID-ySrZFg99rS06wMwI23ARABIABgyYb_h_Cj7BKCARdjYS1wdWItODY3NjU2MDU5ODI5NjY4MqABlfWb3wPIAQngAgCoAwGqBP8BT9Ak3Ye1fIWa-gohcUQE7uofRDhOdqauIoPKzoqK6Fq0t4wQICH8zh3ZUrB6UmEoKsp6S-5qO8Yc6Rdbton8k5diBttz6qKSlkcVOy_FBR41ya1tMLYQ3VD9s3foqHTfk32LjFMiJejfOPCHm453bF7sOtn0LBjuCJo4GoO6W186zi-ZhmF75GvENUZlPQUbsThIP_bN79lIBlRdzJaqm-shF7IP-n2TMhvsVRVRrxSAiL9SVb-PdS07stvYYV52pkq9WEEGm_0dPxjoNoPMpN4xIIzlH1mdoDDr1uWCLWloYxe2X2nx5lzQw6uWh5IeN1OIrkt9p1OrBbk0uhTt4AQBgAadjYrt1Y3fjpoBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgECACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItODY3NjU2MDU5ODI5NjY4MhiC3yI&sigh=2ZTp99_80kQ&uach_m=[UACH]&cid=CAQSPACNIrLMzutqbC6yGwHa5M3qsRK51Qiw5vN2RX7ix8PeNzznGwmUDaOlTd84RBuj50nGfKWcQifkIRaw8hgB
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H2 200 log
hblg.media.net/ Frame E1D0 35 B
0 26ms
21ms Fetch
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hblg.media.net/log?logid=kfk&evtid=l1log&app=0&cc=US&ctr=0.001261034&viewability=89&device_id=4&cbdp=0.017&slotVisibility=1&dn=xmod.in&acid=8918e90d3af6406da1fdbe106ea751ad&ugd=4&size=300x250&pvid=9&csip=rtb-appnexus-7cfb9985db-kgx5g.SC&ogbdp=0.03&prvReqId=32564407947884_243197021_116211091191&itype=ADX&requrl=https%3A%2F%2Fxmod.in%2Fblog&scrid=1700080807683300300025000000500&mang=1&bidrestime=1657311463100&cid=8CUU9JF8H&rme=nurl
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame E1D0 35 B
0 22ms
18ms Fetch
image/gif 23.219.92.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&ckfl=0&lper=&app_type=adx&bdr_typ=2&ss_d1=0&ogerpm=0.0000&ss_d2=0&stid=&other_prv=9&jar_err=&current_day=5.0&adtyp=0&req_id=YsiQ5wAAepAKh4tTBQzZig&bd_m3=0.0000&dmm_d36=NA&bidfp=0.0100&bd_m2=0.0000&pvag_id=&bd_m1=0.0000&ugd=4&dim10=false&predicted_wr=63.0285&exp=&second_bidder=*&search_res=44&floor_bucket=0.00&gpid_format=&seat=&size=300x250&url_l1=blog&f_seg=segment_broad_technology_computing&prdp=0.0168&ogcbdp=0.0300&dfpbd=0.0168&server=1&ogerpm_wd_bkt=0-1&model_version=202207081238_generic_adx_2-cid_2&viewability=0.8900&dmm_r=0.6290&cut=44&dmm_l=0.0070&as_cache=1&tcyerpm=&sc=IL&send_erpm=true&dmm_m9=0.0000&sd=1&hb_exp=&seg=arc_health_8%2CComputing%2Ccpa_auto_ins_pop_cat%2Ccpa_auto_ins_pop_cat_mixed%2Ccpa_wheels_ap%2CInternet%2Csegment_broad_technology_computing%2CSocial_Networking%2CTechnology_and_Computing&dmm_m4=0.0000&erpm_bucket=0.00&ugd_ver=&requrl=xmod.in%2Fblog%2F&bidrestime=1657311463100&cc=US&strg=harmony&ss=&current_hour=19&time_stamp=2022-07-08+20%3A17%3A43&model_key=generic_adx_2-cid_2&rvshhon=&mul_ratio=0.0000&bdp=0.0300&ct=Chicago&akey=&mnckfl=0&bdp_bucket=0.05&algo=default&dc=east_sc&splid=&dim4=exploration&dn=xmod.in&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F103.0.5060.53+Safari%2F537.36&buyer_id=&bdp_wider_bucket=1&acid=8918e90d3af6406da1fdbe106ea751ad&infl=&o_ver=NT+10.0&br_ver=103.0.5060.53&bdmm_m6=0.8690&bdmm_m7=0.8450&bdmm_m5=0.9030&ver=8.12.0&totalTimeBucket=2&visibility=1&totalTime=2723820&dmm_m1=2022-07-08+20%3A17%3A43.102193836&e_rpm=0.0430&dmm_m22=0.0000&gdpr=&vsid=&log_less=false&gpid_sent=false&ogerpm_used=false&bdmm_m12=0.6640&cid=8CUU9JF8H&bcrid=1700080807683300300025000000500&rawbid=0.0300&sub_bidder=0&pst=EMS&pbshr=100.0000&dmm_d10=0&o_id=101&clisp=rtb-appnexus-7cfb9985db-kgx5g.SC&dfp_bucket=0.0&adblk=1921342282&itype=adx&pvid_seat=9&cliIP=2503514368&advurl=topics.businessfocus.online%2F&level_base=0&crid=116211091&sat=1&br_id=265&cut_bkt=45&gpid=&iwb=1&dmm_d22=0.00&second_bid=0.000000&sc_pvid=9&capd=0&other_bids=0.03
Requested by: Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.219.92.153 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-219-92-153.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame E1D0 194 KB
67 KB 42ms
37ms Script
text/javascript 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU7Q771E

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

0ed0eb1dcc83339cd7de5c46e8dfddf0ce7fa1d6879084b1d6f106bf391247b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-mnt-h: 21-6005
content-encoding: gzip
etag: "ef49657083890d9d25b0cf45f9621f06"
x-mnt-w: 8-10
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Fri, 08 Jul 2022 20:17:43 GMT
x-cache-hits: 0
strict-transport-security: max-age=31536000
timing-allow-origin: *
expires: Fri, 08 Jul 2022 20:22:43 GMT

GET
H2 200 adperformance.js Show response
warp.media.net/rtb/resource/ Frame E1D0 61 KB
62 KB 25ms
22ms Script
application/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resource/adperformance.js?v=35e90bcdc8

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

3378135f525fc551ce49d2c117e9967735794757a4c71910d8c1b8fa38bf3f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=604800
server: nginx
date: Fri, 08 Jul 2022 20:17:43 GMT
content-type: application/javascript;charset=ISO-8859-1
cache-control: max-age=53696
access-control-allow-credentials: true
content-length: 62892
expires: Sat, 09 Jul 2022 11:12:39 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame E1D0 3 KB
1 KB 22ms
19ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/window_focus_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 764
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:04:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E1D0 137 KB
42 KB 48ms
45ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e49548c45f00bbfa0fda642d02b5e29b407004eacc2099e348da7cb38f477052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43254
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1657132091081416"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/ Frame E1D0 17 KB
7 KB 22ms
20ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 666
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Jul 2022 20:06:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E1D0 0
0 41ms
39ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT1xrFeZXzHoa_fWU52BP_Bk3y1wjr1SUXRB4acG57ivf3QcGXVuKThFZSmCkPopSR2J-wr7zOC6OF0zcUtCbk2ntkHBw
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame E1D0 22 KB
7 KB 23ms
21ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 06:34:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222173
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 06 Jul 2023 06:34:50 GMT

GET
H/1.1 200 ptrack Show response
a.audrte.com/ Frame A58E 368 B
881 B 60ms
32ms XHR
text/plain 54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptrack?arlocation=149.56.153.179&p=M1353665098&artime=2022-07-08T20:17:43.897Z&arlocation=YWRzLnVzLmUtcGxhbm5pbmcubmV0L3VzcGQvMT9kdT1odHRwcyUzQSUyRiUyRnN5bmMuYWR0ZWxsaWdlbnQuY29tJTJGY3N5bmMlM0Z0JTNEYSUyNmVwJTNEMzA3OTcxJTI2ZXh0dWlkJTNEJTI0VUlE&gdpr=0&gdpr_consent=null&gdpr_version=1&arreferer=cy5hZHRlbGxpZ2VudC5jb20v
Requested by: Host: a.audrte.com
URL: https://a.audrte.com/ptag?p=M1353665098
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 3542f03a4033a86f90d074ffdb890d981b052c1da9d0b160ddd4052862593cd1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: https://ads.us.e-planning.net
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 264

GET
H2 200 optimus_rules.json Show response
tags.crwdcntrl.net/lt/c/15238/ Frame A58E 155 B
628 B 44ms
15ms XHR
application/json 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/15238/optimus_rules.json
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1b92260a400bea230772ccfff1953fbe65deeb30da1a8aa146342d20833f24ff

Request headers

Referer: https://ads.us.e-planning.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 08 Jul 2022 19:04:02 GMT
via: 1.1 c3e66686bc7ab6e675ee9210e15097b6.cloudfront.net (CloudFront)
age: 4422
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 155
last-modified: Wed, 15 Jun 2022 17:05:13 GMT
server: AmazonS3
etag: "1a1722e9cedbdc8af0dcd3345e46c73a"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: max-age: 86400
x-amz-cf-pop: JFK50-P4
accept-ranges: bytes
x-amz-cf-id: ZEB1PHwJdqg0LCDW_WchEp3CmusMd233RsCFQnlj9S2zcbiaolY9ag==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B54C
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_cver=1&google_push=ARnp8GBzgAg1ShyLrJID0s2z2sQfUJ8fJhmBlcBZ6pq7EtYFBoQSbP5...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=2adf2f69ebaf122c&is_secure=true&networkId=14000&version=1&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_cver=1&google_push=ARnp8GBzgAg1...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGc64WYSPzgAN7E3q7AAAAAAA&expiration=1657397864&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA...

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGc64WYSPzgAN7E3q7AAAAAAA&expiration=1657397864&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_push=ARnp8GBzgAg1ShyLrJID0s2z2sQfUJ8fJhmBlcBZ6pq7EtYFBoQSbP510yFfbKcC_iiffWBNVzUlKGFSxRtGE_uGEUoLO8rITg

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGc64WYSPzgAN7E3q7AAAAAAA&expiration=1657397864&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_push=ARnp8GBzgAg1ShyLrJID0s2z2sQfUJ8fJhmBlcBZ6pq7EtYFBoQSbP510yFfbKcC_iiffWBNVzUlKGFSxRtGE_uGEUoLO8rITg
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1

200
OK

cm
a.rfihub.com/ Frame B54C
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEO2Ov0oA5zBA2p4UAvCeKuo&google_cver=1&google_push=ARnp8GBLbVjbSv8L64GR9cxOPMDXcmqpg-UIRQ8NNJHGmXiBDeBIYgpMO6CQhy-WCDmc5ppyM-oV-121wiOIBqTLUH64Ov4dxQ
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ARnp8GBLbVjbSv8L64GR9cxOPMDXcmqpg-UIRQ8NNJHGmXiBDeBIYgpMO6CQhy-WCDmc5ppyM-oV-121wiOIBqTLUH64Ov4dxQ&google_hm=MTc4Mzc3NzMxN...
https://a.rfihub.com/cm?pub=445&google_error=5

42 B
810 B

20ms
19ms

Image
image/gif

199.38.167.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.rfihub.com/cm?pub=445&google_error=5
Protocol: HTTP/1.1
Server: 199.38.167.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Cache-Control: no-cache
Server: Jetty(9.3.29.v20201019)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://a.rfihub.com/cm?pub=445&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B54C
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESEP6G3GpnaDJpeSu_24IcBhs&google_cver=1&google_push=ARnp8GB9I9-Fm4bGNflblo9XFOKE8qujVf_qN4nHYlDu3OFN2r0hTRcmUokEENcVFxGR7SWiYfr...
https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESEP6G3GpnaDJpeSu_24IcBhs&google_cver=1&google_push=ARnp8GB9I9-Fm4bGNflblo9XFOKE8qujVf_qN4nHYlDu3OFN2r0hTRcmUokEENcVFxGR7SWiYfr...
https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=DRZek0s8QrKvMvKCl43Hbg

170 B
188 B

38ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=DRZek0s8QrKvMvKCl43Hbg

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=DRZek0s8QrKvMvKCl43Hbg
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B54C
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENXocMcldTMxQT3EY-SMxUI&google_cver=1&google_push=ARnp8GCZ5k18crQZl4Vvsao8g2A5edsVh12HqMjwm8o-pxf9Xbacja_EEgZVRgvHEnjjhiDWkgjQPNUf...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GCZ5k18crQZl4Vvsao8g2A5edsVh12HqMjwm8o-pxf9Xbacja_EEgZVRgvHEnjjhiDWkgjQPN...

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GCZ5k18crQZl4Vvsao8g2A5edsVh12HqMjwm8o-pxf9Xbacja_EEgZVRgvHEnjjhiDWkgjQPNUfjO0y__PgSdvaUaBeSzk

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzUxNzg5OTY3MTU2MzU4MzQyMQ&google_push=ARnp8GCZ5k18crQZl4Vvsao8g2A5edsVh12HqMjwm8o-pxf9Xbacja_EEgZVRgvHEnjjhiDWkgjQPNUfjO0y__PgSdvaUaBeSzk
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B54C
Redirect Chain

https://a.clickcertain.com/px/img/g/?google_gid=CAESECHEPHtzmd5N2HXQtw9Pphw&google_cver=1&google_push=ARnp8GDacnR6HqGXwz6x9QuxkHefWLZkxxgZ8KHcOnf_yvyrDXJ5tWzWlSm8_3JgSgTiCmMYQQoC8-PiwdPmKhehL0QjC9Y...
https://i.liadm.com/s/56408?bidder_id=200441&bidder_uuid=e8692212-0d67-4939-8b14-e99241d31e09&ccid=e8692212-0d67-4939-8b14-e99241d31e09&redir=https%253a%252f%252fsecure%252eadnxs%252ecom%252fgetuid...
https://i.liadm.com/s/56408?redir=https%253a%252f%252fsecure%252eadnxs%252ecom%252fgetuidu%253fhttps%253a%252f%252fa%252eclickcertain%252ecom%252fpx%252fimg%252fg%252f%253fdone%253dtrue%2526google_...
https://a.clickcertain.com/px/li/?redir=https%3a%2f%2fsecure%2eadnxs%2ecom%2fgetuidu%3fhttps%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fimg%2fg%2f%3fdone%3dtrue%26google_gid%3dCAESECHEPHtzmd5N2HXQtw9Pph...
https://secure.adnxs.com/getuidu?https://a.clickcertain.com/px/img/g/?done=true&google_gid=CAESECHEPHtzmd5N2HXQtw9Pphw&google_cver=1&google_push=ARnp8GDacnR6HqGXwz6x9QuxkHefWLZkxxgZ8KHcOnf_yvyrDXJ5...
https://a.clickcertain.com/px/img/g/?done=true&google_gid=CAESECHEPHtzmd5N2HXQtw9Pphw&google_cver=1&google_push=ARnp8GDacnR6HqGXwz6x9QuxkHefWLZkxxgZ8KHcOnf_yvyrDXJ5tWzWlSm8_3JgSgTiCmMYQQoC8-PiwdPmK...
https://cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_push=ARnp8GDacnR6HqGXwz6x9QuxkHefWLZkxxgZ8KHcOnf_yvyrDXJ5tWzWlSm8_3JgSgTiCmMYQQoC8-PiwdPmKhehL0QjC9YMl7w&google_hm=ZTg2OTIyMTItMGQ2...

170 B
188 B

52ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_push=ARnp8GDacnR6HqGXwz6x9QuxkHefWLZkxxgZ8KHcOnf_yvyrDXJ5tWzWlSm8_3JgSgTiCmMYQQoC8-PiwdPmKhehL0QjC9YMl7w&google_hm=ZTg2OTIyMTItMGQ2Ny00OTM5LThiMTQtZTk5MjQxZDMxZTA5

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:44 GMT
x-frontend: cc-nginx-6658f656f4-g69jh:cc-nginx-6658f656f4-g69jh
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-requestid: c2b7c694-eb8d-9488-b0dd-4de808b02302
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eJt49XIW8hs17FEYopCEaEb47bXY5b7w3pKlDV1Sh3RWLSAOj2rAZo0Th5u%2BGwfOKFaYVL6tSNdGzed1z38DoJ%2BOlEqbfZh38pSUlStWKxRviVcK7S70yW%2F4trhfkuMZNRRXk87%2B4wTDhBrz1NORqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_push=ARnp8GDacnR6HqGXwz6x9QuxkHefWLZkxxgZ8KHcOnf_yvyrDXJ5tWzWlSm8_3JgSgTiCmMYQQoC8-PiwdPmKhehL0QjC9YMl7w&google_hm=ZTg2OTIyMTItMGQ2Ny00OTM5LThiMTQtZTk5MjQxZDMxZTA5
x-envoy-upstream-service-time: 50
cf-ray: 727b814f3d994bbf-YUL

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B54C
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEH7XH_NvafWPOChDoAjA1nU&google_cver=1&google_push=ARnp8GCiOg8edSHFAMHUgL5X_BEGCg2RXh3rAQtuff41SELmUJK9iU1vClRUdrjdeeaDNKPrl1aE_O...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GCiOg8edSHFAMHUgL5X_BEGCg2RXh3rAQtuff41SELmUJK9iU1vClRUdrjdeeaDNKPrl1aE_OfiqgWd__AfwvY-RXwQNdc&google_hm=NzIzNDI5NjA...

170 B
188 B

36ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GCiOg8edSHFAMHUgL5X_BEGCg2RXh3rAQtuff41SELmUJK9iU1vClRUdrjdeeaDNKPrl1aE_OfiqgWd__AfwvY-RXwQNdc&google_hm=NzIzNDI5NjA5ODg1NDQxMjU5Ng%3D%3D

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ARnp8GCiOg8edSHFAMHUgL5X_BEGCg2RXh3rAQtuff41SELmUJK9iU1vClRUdrjdeeaDNKPrl1aE_OfiqgWd__AfwvY-RXwQNdc&google_hm=NzIzNDI5NjA5ODg1NDQxMjU5Ng%3D%3D
date: Fri, 08 Jul 2022 20:17:43 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B54C
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEDgPyFZHwjpKKaus0NiP9nE&google_cver=1&google_push=ARnp8GApD3oT4GvebwtaA5cWl5oXHNLnKe194RmvihbQ1weBamoRtpFxH9siV07PkOPWa62nN_WlVYbv5qJ_Fbe...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=P4z4kzBFTkavqEPjje7zNg&google_push=ARnp8GApD3oT4GvebwtaA5cWl5oXHNLnKe194RmvihbQ1weBamoRtpFxH9siV07PkOPWa62nN_WlVYbv5qJ_FbeJoZSbs3IXvU9N

170 B
188 B

38ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=P4z4kzBFTkavqEPjje7zNg&google_push=ARnp8GApD3oT4GvebwtaA5cWl5oXHNLnKe194RmvihbQ1weBamoRtpFxH9siV07PkOPWa62nN_WlVYbv5qJ_FbeJoZSbs3IXvU9N

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=P4z4kzBFTkavqEPjje7zNg&google_push=ARnp8GApD3oT4GvebwtaA5cWl5oXHNLnKe194RmvihbQ1weBamoRtpFxH9siV07PkOPWa62nN_WlVYbv5qJ_FbeJoZSbs3IXvU9N
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Kestrel
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B54C 0
12 B 43ms
34ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LvXbNegdgLhB3i6Ye_jcegAMITQS6Zozk502_R_5-VUynVn_m8KDAuCzUbWuv_eTvN2lHE2Q

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js Show response
pagead2.googlesyndication.com/bg/ Frame E796 36 KB
14 KB 28ms
23ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PBLy2ghsJAjz8SVbRXt3mPeTz3f3ksFMZv27m_PD6qM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c12f2da086c2408f3f1255b457b7798f793cf77f792c14c66fdbb9bf3c3eaa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 06 Jul 2022 19:02:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 177329
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13888
x-xss-protection: 0
last-modified: Fri, 01 Jul 2022 16:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 06 Jul 2023 19:02:14 GMT

GET
DATA 200
OK truncated
/ Frame 4E15 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4E15 392 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e77c90e99e4f3d8bfee943438c880353dd29b41f87271cdde77988a6db2dcd9c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4E15 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK OpenSans_Bold.woff
res-a.akamaihd.net/__media__/fonts/OpenSans_Bold/ Frame 4E15 25 KB
25 KB 20ms
18ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/OpenSans_Bold/OpenSans_Bold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TFY50V9&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463271061731&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=8fOnRrolnfOur8B4zx%2FBge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808001265&kapc=10&ekals=775EJvu99ui%7C%7CENvu9%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1973bb0e810b8f54792d7ea56c03749f6792541876847b085f58d64fb7adfc07

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-6478"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25720

GET
H/1.1 200
OK OpenSans_Semibold.woff
res-a.akamaihd.net/__media__/fonts/OpenSans_Semibold/ Frame 4E15 21 KB
21 KB 22ms
18ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/OpenSans_Semibold/OpenSans_Semibold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TFY50V9&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463271061731&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=8fOnRrolnfOur8B4zx%2FBge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808001265&kapc=10&ekals=775EJvu99ui%7C%7CENvu9%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 2a354649f57a81405daccfd6b5785da5f73ba638f2db591992cb7b739dac3135

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-54c8"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21704

GET
H/1.1 200
OK OpenSans-Regular.woff
res-a.akamaihd.net/__media__/fonts/OpenSans-Regular/ Frame 4E15 66 KB
66 KB 21ms
19ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/OpenSans-Regular/OpenSans-Regular.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TFY50V9&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463271061731&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=8fOnRrolnfOur8B4zx%2FBge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808001265&kapc=10&ekals=775EJvu99ui%7C%7CENvu9%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 5256d55a499ecb71f04dd716cfdf75bf9fe5f863620ec6634e3b43b4e6b11fd8

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-107c8"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 67528

GET
H2 200 lt.iframe.html Show response
tags.crwdcntrl.net/lt/shared/2/ Frame 048C 2 KB
1 KB 18ms
18ms Document
text/html 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=15238
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 63cf7a38baaaaebc012cfc355797544949b60c040b5da57560f26d88502d1372

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 4429
cache-control: max-age: 86400
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 19:03:55 GMT
etag: W/"6fcf4f5197ab24c92d090f6ac8d87e01"
last-modified: Mon, 01 Feb 2021 20:35:17 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
x-amz-cf-id: AqDNVj0hpyNiWB3hhAKXigGbV4hO2e3wPKJ11JvQ1Jt2I5mRhHsW3Q==
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H/1.1 200
OK merge Show response
ce.lijit.com/ Frame BD46 43 B
4 KB 22ms
20ms Document
image/gif 23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=71&3pid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 43
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:43 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ewr1

GET
H/1.1

204
No Content

/
io.narrative.io/ Frame 1E4C
Redirect Chain

https://io.narrative.io/?companyId=673&id=pubmatic_id:E614708A-96BB-452C-8A92-C68CD106CB31
https://io.narrative.io/?io.narrative.guid.v2=067d8ae0-fefb-11ec-9ff5-0668079b7b33&companyId=673&id=pubmatic_id:E614708A-96BB-452C-8A92-C68CD106CB31

0
247 B

24ms
24ms

Image
text/plain

52.2.65.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://io.narrative.io/?io.narrative.guid.v2=067d8ae0-fefb-11ec-9ff5-0668079b7b33&companyId=673&id=pubmatic_id:E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: HTTP/1.1
Server: 52.2.65.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-65-122.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Cache-Control: no-cache
Server: nginx/1.18.0
Connection: keep-alive

Redirect headers

Location: https://io.narrative.io/?io.narrative.guid.v2=067d8ae0-fefb-11ec-9ff5-0668079b7b33&companyId=673&id=pubmatic_id:E614708A-96BB-452C-8A92-C68CD106CB31
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx/1.18.0
Connection: keep-alive
Content-Length: 0

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame 1E4C 49 B
264 B 37ms
35ms Image
image/gif 52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=E614708A-96BB-452C-8A92-C68CD106CB31&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=&gdpr_consent=&us_privacy=1---&dnr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.7.231
content-type: image/gif
content-length: 49
expires: 0

GET
DATA 200
OK truncated
/ Frame 9DB8 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9DB8 244 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 594ed7996b7849cd5fe2f1bd8c591db9723f1664de3282ac83a290907ee6632a

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9DB8 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK OpenSans_Bold.woff
res-a.akamaihd.net/__media__/fonts/OpenSans_Bold/ Frame 9DB8 25 KB
25 KB 19ms
18ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/OpenSans_Bold/OpenSans_Bold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T5KC7JQ&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463845468988&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=B4zx%2FB8fOnRrolnfOur8ge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058573&kapc=18&ekals=775EJvu99ui%7C%7CENvuW%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1973bb0e810b8f54792d7ea56c03749f6792541876847b085f58d64fb7adfc07

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-6478"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25720

GET
H/1.1 200
OK Poppins_Bold.woff
res-a.akamaihd.net/__media__/fonts/Poppins_Bold/ Frame 9DB8 21 KB
21 KB 20ms
19ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Poppins_Bold/Poppins_Bold.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T5KC7JQ&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463845468988&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=B4zx%2FB8fOnRrolnfOur8ge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058573&kapc=18&ekals=775EJvu99ui%7C%7CENvuW%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ab0d99a570f1a73138d44dbf0b7f361a4b1cb86529a14ef41e9828b00c62b883

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Last-Modified: Thu, 15 Dec 2016 16:30:17 GMT
Server: nginx
ETag: "5852c519-5464"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21604

GET
H/1.1 200
OK Poppins_Regular.woff
res-a.akamaihd.net/__media__/fonts/Poppins_Regular/ Frame 9DB8 124 KB
124 KB 20ms
19ms Font
application/font-woff 23.63.77.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Poppins_Regular/Poppins_Regular.woff
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T5KC7JQ&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463845468988&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=B4zx%2FB8fOnRrolnfOur8ge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058573&kapc=18&ekals=775EJvu99ui%7C%7CENvuW%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.63.77.202 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-63-77-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: d418cfc8510d0bfb42c808cd368ee91ab0a71c8c4b321ea47cf76c468c34eaba

Request headers

Referer: https://contextual.media.net/
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Last-Modified: Wed, 09 Nov 2016 16:33:23 GMT
Server: nginx
ETag: "58234fd3-1ef30"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 126768

POST
H2 200 data Show response
bcp.crwdcntrl.net/6/ Frame A58E 142 B
1006 B 82ms
82ms XHR
application/json 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/data
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 31bbb926a961e713fab194410549cf20f6642aea582e95133b0c58418ffe4986

Request headers

Referer: https://ads.us.e-planning.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://ads.us.e-planning.net
cache-control: no-cache
x-server: 10.40.33.113
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 142
expires: 0

GET
H/1.1 200
OK browserfp.min.js Show response
pxlclnmdecom-a.akamaihd.net/javascripts/ Frame E1D0 98 KB
32 KB 220ms
39ms Script
text/javascript 184.29.143.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU7Q771E&noCookies=true
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU7Q771E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 184.29.143.176 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-29-143-176.deploy.static.akamaitechnologies.com
Software: / Express
Resource Hash: 6badf9a996ebb7f9725c25a08bdf540e5f433567ed5f3dc5e1aa6b1d36e86a49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Content-Encoding: gzip
x-powered-by: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Cache-Control: max-age=300
Connection: keep-alive
Content-Length: 32797
Expires: Fri, 08 Jul 2022 20:22:44 GMT

GET
H2 200 smtr Show response
contextual.media.net/ Frame E1D0 95 KB
35 KB 254ms
254ms Script
text/javascript 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU7Q771E&cpcd=QcqgoxBu_JEBy1__-rrJcw%3D%3D&crid=216119548&size=300x250&cc=CA&sc=QC&chnm=HARMONY&pid=8PO6CSQ66&tpid=T1E3668&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463537139879&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4/&bcpf=B4zx%2FBge48fOnRrolnfOur8%2F&bdrId=9&ntv=0&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808076833&kapc=10&ekals=775EJvu99ui%7C%7CENvu9%7C%7Ck17vf%7C%7C7Gk7vf&kata=aton&ekalog=PPVrvwW%20KaVx1BHlhaRr7B%7C%7C%3DVvfhHW%7C%7CbVvfhX9%7C%7CbVrvW%7C%7C_TVrvF%7C%7CqVrv9%7C%7Cc0_rvufW%7C%7C_0_rvFAhiXhfh9FhFHWH%7C%7CcVvfhX9&pgid=p1947862235t202207082017&goent=1&nb=1&cadomain=tzR-hLcl-L81q0bo4F7GnA3mMwDIDjC2d77KxBXphR_fTCDUsmLZYQ%3D%3D&allsc=QC&tcf_cmp=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU7Q771E

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

1e36e7f8f3a537ef4c0e489caec0ee4ca613d3df2673b48f73539cde0771eb1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
expires: Fri, 08 Jul 2022 20:17:44 GMT
cache-control: max-age=0, no-cache, no-store
x-sc-h: 21-b6bf
strict-transport-security: max-age=31536000
timing-allow-origin: *
content-length: 35465
x-sc-w: 21-c9w3

GET
H2 200 bping.php
lg3.media.net/ Frame E1D0 35 B
189 B 26ms
26ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=531&&gdpr=0&prid=8PRVCXX19&cid=8CU7Q771E&crid=216119548&vi=1657311463537139879&ugd=4&lf=6&cc=CA&sc=QC&vsid=3003130611454751&lper=100&wsip=2886781041&r=1657311464041&requrl=https%3A%2F%2Fxmod.in%2Fblog&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=16276&vgd_rakh=1657311463101446486&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_pgid=p1947862235t202207082017&vgd_pgids=1&vgd_uspa=0&hvsid=00001657311464037025035145473327&gdpr=0&vgd_end=1

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:44 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:44 GMT

GET
H/1.1

200

p
a.audrte.com/ Frame A58E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=&google_gid=CAESEHmWZqJfwGeylKuche3ULRQ&google_cver=1
https://a.audrte.com/p

68 B
617 B

26ms
25ms

Image
image/png

54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Protocol: HTTP/1.1
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

p
a.audrte.com/ Frame A58E
Redirect Chain

https://dmp.adform.net/serving/cookie/match/?party=1003&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=7517899671563583421
https://a.audrte.com/p

68 B
617 B

25ms
25ms

Image
image/png

54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Protocol: HTTP/1.1
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/ Frame A58E
Redirect Chain

https://ps.eyeota.net/pixel?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
https://ps.eyeota.net/pixel/bounce/?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=

1 KB
1 KB

538ms
538ms

Image
application/javascript

52.55.144.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Content-Type: application/javascript
Content-Length: 1248
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /pixel/bounce/?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
Date: Fri, 08 Jul 2022 20:17:44 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 4E15 15 B
216 B 36ms
35ms Script
text/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=5252&&&vgd_l2type=sca&fp=yzzAfwSZMQYDIuI3H0cMifOjuM6fa10xmptSGrGHiHCOvT1NDe5brbjDToBvPUdqxA_y7Ov2jAbTsyDsa8MxbvICM7vD3PnZj6MQTk-orPbGaFgtlQ3bMbFwkyWLc4-m&cme=H77b5y6vl1rMMrwjXl3JH6R4IkIf3a7IMzdrdY2uoLgsbILA-OqyGAy-ccfFs7rBH15FGEC9FwybMqh9LhhdgdY60X3VBbftfEw_MtZuv3ExpV_8SXXkaR_7AbqpnapfDwdx_NUPZuTtX0sWLGMPEjC6ACLjFVRnqz0ASjfkW2zlIKWnSvF3xo-T4Go26X-T1nDVZhANGNNHtf9hicvzak1npDiTBIRR%7C%7CJwgYdc1KQkFA0AkMtcoUY9olDV92JfOo%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD6YYKAfSVuGWyUY6vyv8InEJ2xnHJ5H_0o%3D%7CfJk0Fl1bRaWEXz6Hm6pwtK_URXSNt6Q-lBie-NS6hjojwA5bj4jeO7PYCElMlGJ8qTVgG1IyVvrErohrF5MifRfGMbad-J7x0sq887EKM38LbjcpmorJgM1_mJIM7p2prDINLiv9emvJ0rPzr-hlBnnEmkMl-Zlmu5X2j8IzEGjkGIFetJIiZmKKPahPoe3AqI_HXWFWQ9FGuMkIPej3Jka3ceGV0CeCAazUW3hVbq1OhaJ44R6Mzh9nLU4EdY9cJWAPfao5N84%3D%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7C&v=1&geo=45.5%7C-73.58&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=&cc=CA&wsip=170721308&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nfu&vgd_fm_lang=EN&vgd_dnquo=00_XX&ksu=224&fdkt=374&vgde_kbbh=fuoNWNY&kwd[]=WordPress+Hosting+Services&kwt[]=374&kbc[]=156583&kwp[]=1&kid[]=316611362&kbc2[]=5%3D9194%7C6%3D2%7Co_r%3D0.25%7Cp_r%3D0.17%7Cl_r%3D42%7Cc%3D-145%7C1%3D0.57%7C2%3D6.65%7C3%3D1.75%7C4%3D1.29&ktd[]=1126174801527296&kwd[]=Top+3+Stocks+to+Buy&kwt[]=375&kbc[]=32871&kwp[]=2&kid[]=321206339&kbc2[]=%23c%3A3473961%7Co_r%3D0.13%7Cp_r%3D0.20%7Cl_r%3D46%7Cc%3D-8%7C5%3D-1%7C6%3D-1%7C1%3D0.48%7C2%3D3.65%7Cps%3D0.976%7C3%3D1.24%7C4%3D4.17&ktd[]=1126174818304768&kwd[]=10+Best+Auto+Insurance+Rates&kwt[]=267&kbc[]=56840&kwp[]=3&kid[]=330067967&kbc2[]=56840%7C%7C%7Co_r%3D0.33%7Cp_r%3D0.25%7Cl_r%3D138%7Cc%3D420%7C5%3D-1%7C6%3D-1%7C1%3D4.67%7C2%3D18.43%7Cps%3D0.794%7C3%3D0.74%7C4%3D1.00&ktd[]=274895016704&kwd[]=Name+Your+Own+Star&kwt[]=390&kbc[]=208%3A%3A1261621781&kwp[]=4&kid[]=20083796&kbc2[]=5%3D13313%7C6%3D4%7Co_r%3D0.18%7Cp_r%3D0.22%7Cl_r%3D42%7Cc%3D68%7C1%3D0.11%7C2%3D2.05%7C3%3D0.48%7C4%3D2.85&ktd[]=1126174801527296&kwd[]=Watch+Live+Online&kwt[]=374&kbc[]=250055&kwp[]=5&kid[]=180959746&kbc2[]=5%3D3268%7C6%3D3%7Co_r%3D0.38%7Cp_r%3D0.47%7Cl_r%3D44%7Cc%3D860%7C1%3D0.24%7C2%3D2.02%7C3%3D0.27%7C4%3D3.74&ktd[]=1126174818304512&cid=8CU5RJ1PV&vwid=1657311463271061731&vi=1657311463271061731&tdAdd[]=ib%3D0&vsid=3003130611454751&tdAdd[]=asnum%3D16276&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_l3_sc=QC&vgd_chost=contextual.media.net&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_kals=ttype%3D10019%7C%7Cpc%3D10%7C%7Cfat%3D1&vgd_kalog=HID%3D2%7C%7CSID%3D8%7C%7CUUID%3Dh8qAqUBh3ezbHu4Kj%7C%7CTLID%3D6%7C%7CSI%3D2750%7C%7CMI%3D2750%7C%7CCI%3D2748%7C%7CTPTD%3D565939259188228%7C%7CMPTD%3D128&vgd_katid=808001265&vgd_katbid=-21&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170721308&vgd_nrrv=54023&vgd_nrrmf=4848&vgd_nrrsf=scrr&vgd_cty=montreal&vgd_go_pid=8POPGE52H&&vgd_ifrmode=14&vgd_l1rakh=1657311462190909608&sttm=1657311463206&upk=1657311463.26179&hvsid=00001657311463206025035145478280&verid=3111299&vgd_matchstr=hr%3D0%7C&sbdrId=186&vgd_vsidtv=000V10&vgd_ecrid=1700080800126500300025000001000&vgd_isiolc=1&vgd_fcm_enc_mis=1&&kbbq=%26asn%3D16276&&vgd_vstrid=3003130611454751&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.Xu~e8QMQOvuii~xLjMLEQMGvF.HA~OmYMGvu~ONfvu~QNOv%20N~eM1QzvuFfhF~OmYMjvf9~ejfLMQOvf9ff9h9W9W~8xLjMGvhuh.uu~xLjM7UNvi~xLjMLf1MGv9~Q7Ov~c0v.*Gjmy.*~j1Q7v~e8QMxLjMGv9.XH~8Evf6%20xQ9~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vAA~LNvA%2CWAA~L8Qx8Ov9%2C9~LEQMQOvf9ff9h9WuA~e8QMGvXW9.fF~xLjMGvu.Ai~ejfLMxLjMGv9.9f~ejfLMxLjMe8vHh9~xLjM7e8vHFF~xLjMjvf9~yN17vX9u9ff~GGvuWF~eev9~NejfLMQOvuiF~jfLMGvu999~JLEYv9.Xu~ejfLMxLjMUNvu4u~ejfLMxEMjvf9~GYvu~Q8OvWHXuuFXWF~QOvu~x8OvwWy%20TycVGPI7HTGtT~xLjMLEQMUNvu~NejfLMGvA.uf~G7OviHfWXAf9HuXfHf9ffXi9hX9AHiF9XX9uhW9iW999uuHufi9u9XXhiAuH99iXFFfFfAFWuhhufufW99~Nejfvui.hf~AENkvu999.Au~x8Yv9~OYYMQ7Lyvw1LYmz5~ejfLMxEMGv9.9f~QQvIK~x8Bvou~NJv9~LEQMGvuAX.Wh~xLjMQLEQMGvuW.AH~%3DVvfh9f~z7Qvu~c0fv.*Gjmy.*~7Gvou~N7vYmz7LJ1j~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~0sv9~8Q8kv9~jNvu~xLjMLENMGv9~G8Ov9.Xu~ONvW~xLjMLEQMLev9~ejfLMGvF.Hf~QxEEj5M71yM8Ov~e8JB1G8j875v9.hW~1YEvu~NGOEv9.Xu9~OYYvw1LYmz5~Qx8Ov%3DK4b44rGGRBa3xyPit_y_rmk4Bc~QyY7vQJyYJz7MGLm1OM7JNwzmjmy5MNmYEx78zy~QOvu~O7NvJ1Q7MQN~-8OvKrtoExGoWFhFXF9XiWfiFFWf~O1jyv~w7Yjvu~1OGjUvXfhf9HuWi~QmGEv9.9f~N7Lv9.99uFWfAFWW~GOEN1EOv9~OYYMJLEYv7LxJ~GkjLv9.9u9~myG8Ov9.Xu9~1NM75EJvu~875EJM8Ovuh~QJjjJLM71yM8Ov~1OMGjUMUJ5vXfhf9HuWi~OJ7JN7JOM71yM8Ov~ONx7vA9~OmyGv9ou~8GNvu~OO7vou~zQlvu~7yQvA99-fX9~GQGv9~GQEv9~7Y-vfHW&vgd_optout=0&vgd_cfud=220317&vgd_scsver=258&vgd_go_ent=1&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_dtc=east_sc&vgd_mbr=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250&&vgd_uspa=0&vgd_sc=QC&vgd_l1rhst=contextual.media.net&hvsid=00001657311463206025035145478280&subBdr=186&bdrid=294&rc=0&rand=1657311463944&acid=801d847da7dc4377ada544c2e5214403&matm=1657311463944&vgd_ltimesrc=1&vgd_ltime=1084&vgd_rtime=983&vgd_etm=12&vgd_l1hcsd=O6005%7C4504&vgd_tcf_cmp=1&vgd_l1ch=1&vgd_lhl=2919&vgd_pgid=p1947862235t202207082017&vgd_adprefflag=10&vgd_adpref_diff=100&vgd_csip=rtb-appnexus-7cfb9985db-b5t6w.SC&vgd_sbSup=1&vgd_vsidv=10&vgd_nrrs=54023&vgd_cntrdt=SF%7Cb97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=845116586&size=300x250&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=TFY50V9&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463271061731&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=8fOnRrolnfOur8B4zx%2FBge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808001265&kapc=10&ekals=775EJvu99ui%7C%7CENvu9%7C%7Ck17vu&kata=aton&ekalog=qVrvf%7C%7CbVrvW%7C%7CPPVrvwW%20K%20PRwAJlGqxHCd%7C%7C_TVrvF%7C%7CbVvfhX9%7C%7CcVvfhX9%7C%7C%3DVvfhHW%7C%7C_0_rvXFXiAifXiuWWffW%7C%7Cc0_rvufW&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:44 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 08 Jul 2022 20:17:44 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B38F
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_cver=1&google_push=ARnp8GB99ATLaDTnKdX-fM_6KFURbXmNcNm0Z4XqUFNSzF64qXbO3HJ...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=275e913f0b61122b&is_secure=true&networkId=14000&version=1&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_cver=1&google_push=ARnp8GB99ATL...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGdL7vkWJqZQN-TiMqAAAAAAA&expiration=1657397864&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA...

170 B
188 B

38ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGdL7vkWJqZQN-TiMqAAAAAAA&expiration=1657397864&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_push=ARnp8GB99ATLaDTnKdX-fM_6KFURbXmNcNm0Z4XqUFNSzF64qXbO3HJ4uHlnK3L-s8nVVoaCPzvjVWjLMEk5GnDyUazKg_gBMSZX

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGdL7vkWJqZQN-TiMqAAAAAAA&expiration=1657397864&google_cver=1&is_secure=true&google_gid=CAESEKnsvl-f6QZzCXlVk7DjA3M&google_push=ARnp8GB99ATLaDTnKdX-fM_6KFURbXmNcNm0Z4XqUFNSzF64qXbO3HJ4uHlnK3L-s8nVVoaCPzvjVWjLMEk5GnDyUazKg_gBMSZX
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B38F
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEHOXcC8uRb8a0_7kei4A3dw&google_cver=1&google_push=ARnp8GCbzMp2aKMWS2W02kZ4a1lPo1AhzAURYfbFl9UnXiBbfYvCTCnCtqi8P17y3pmRIr5InE4evS4CHfk3gfVcXlEuRfTeWVgG
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NEE4QUNBRkVCOURFMjZCRA==

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NEE4QUNBRkVCOURFMjZCRA==

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NEE4QUNBRkVCOURFMjZCRA==
date: Fri, 08 Jul 2022 20:17:44 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B38F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5hRwipa7RSyKksaM0QbLMQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

38ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5hRwipa7RSyKksaM0QbLMQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ARnp8GCpp--aIGr1t9R57qRFIrgKJkHM0icm39OQ1TE3jUNgh-WP4goynwnjpuzizkgmBY7JAnEENtsvmXCLqKycJKEyCcv02VLs

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5hRwipa7RSyKksaM0QbLMQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ARnp8GCpp--aIGr1t9R57qRFIrgKJkHM0icm39OQ1TE3jUNgh-WP4goynwnjpuzizkgmBY7JAnEENtsvmXCLqKycJKEyCcv02VLs
date: Fri, 08 Jul 2022 20:17:43 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B38F
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEGLqROhhEP3wkNunCsYMX0E&google_cver=1&google_push=ARnp8GCZCIgMAGCiwaiBtkI9aqHA7Oa-5Sxb8MBuyOr4rMVhvbXQhROjlG_g48Cd0JKQXiqoSSc1Ly4cuF-YhJ9p...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=85a1a579&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ARnp8GCZCIgMAGCiwaiBtkI9aqHA7Oa-5Sxb8MBuyOr4rMVh...

170 B
188 B

40ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=85a1a579&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ARnp8GCZCIgMAGCiwaiBtkI9aqHA7Oa-5Sxb8MBuyOr4rMVhvbXQhROjlG_g48Cd0JKQXiqoSSc1Ly4cuF-YhJ9pZ8n5a863-YQ

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-P1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=85a1a579&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ARnp8GCZCIgMAGCiwaiBtkI9aqHA7Oa-5Sxb8MBuyOr4rMVhvbXQhROjlG_g48Cd0JKQXiqoSSc1Ly4cuF-YhJ9pZ8n5a863-YQ
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: AZ_OZ6iLh4P_qyueEGtePRArDtrleV423RXjT9UUzS7CP-1839Aleg==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B38F
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEM6EcucQAI6Ehc7sh4Wg0ZE&google_cver=1&google_push=ARnp8GC5zojqc_tmV7cnDt1fNYYGc9icyB4jSUkR0WXw0kFJD_sLcIHkadekfcnpfb8D61WULkPCMCDlRfBjSAP7U0VvLr...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=ZeZ_WugnTzW8fP9jeWLxHw&google_push=ARnp8GC5zojqc_tmV7cnDt1fNYYGc9icyB4jSUkR0WXw0kFJD_sLcIHkadekfcnpfb8D61WULkPCMCDlRfBjSAP...

170 B
188 B

41ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=ZeZ_WugnTzW8fP9jeWLxHw&google_push=ARnp8GC5zojqc_tmV7cnDt1fNYYGc9icyB4jSUkR0WXw0kFJD_sLcIHkadekfcnpfb8D61WULkPCMCDlRfBjSAP7U0VvLrj7MaU

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=ZeZ_WugnTzW8fP9jeWLxHw&google_push=ARnp8GC5zojqc_tmV7cnDt1fNYYGc9icyB4jSUkR0WXw0kFJD_sLcIHkadekfcnpfb8D61WULkPCMCDlRfBjSAP7U0VvLrj7MaU
date: Fri, 08 Jul 2022 20:17:44 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B38F
Redirect Chain

https://rtb2-useast.torchad.com/sync?exchange=309&google_gid=CAESENzJIz8hGUeFUPeXPxaAsqE&google_cver=1&google_push=ARnp8GCSiMMXLVB2uEflp7KL73_zYEL0cxo1Saw77Q72VT3a3KjCW0o-4E02Vqj8Iqt5D8UBQcOqf5lH0_...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.torchad.com%2Fsync%3Fexchange%3D309%26google_gid%3DCAESENzJIz8hGUeFUPeXPxaAsqE%26google_cver%3D1%26google_push%3DARnp8GCSiMMXLVB2uEflp7KL...
https://rtb2-useast.torchad.com/sync?adkuid=A1810852110846290499&exchange=309&google_gid=CAESENzJIz8hGUeFUPeXPxaAsqE&google_cver=1&google_push=ARnp8GCSiMMXLVB2uEflp7KL73_zYEL0cxo1Saw77Q72VT3a3KjCW0...
https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GCSiMMXLVB2uEflp7KL73_zYEL0cxo1Saw77Q72VT3a3KjCW0o-4E02Vqj8Iqt5D8UBQcOqf...

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GCSiMMXLVB2uEflp7KL73_zYEL0cxo1Saw77Q72VT3a3KjCW0o-4E02Vqj8Iqt5D8UBQcOqf5lH0_23A2HNl6QAH8eaFNuE

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=unmatched_solutions_ltd&google_hm=QTE4MTA4NTIxMTA4NDYyOTA0OTk&google_push=ARnp8GCSiMMXLVB2uEflp7KL73_zYEL0cxo1Saw77Q72VT3a3KjCW0o-4E02Vqj8Iqt5D8UBQcOqf5lH0_23A2HNl6QAH8eaFNuE
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B38F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEDEkPeZIJFQdRNhzsZgIbwk&google_cver=1&google_push=ARnp8GCfBj0E9ky4gmnblpR0sGa8mc2rV6zdpK2lqqnGIUZpZLCjJh_2qB4GhyxO2p6zKV1nLJ...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uNnRXWkFCRTJ1R1c1NDJnVXFwRDBWWHhGdEdNeWlTMX5B&google_push=ARnp8GCfBj0E9ky4gmnblpR0sGa8mc2rV6zdpK2lqqnGIUZpZLCjJh_2q...

170 B
188 B

40ms
39ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uNnRXWkFCRTJ1R1c1NDJnVXFwRDBWWHhGdEdNeWlTMX5B&google_push=ARnp8GCfBj0E9ky4gmnblpR0sGa8mc2rV6zdpK2lqqnGIUZpZLCjJh_2qB4GhyxO2p6zKV1nLJcmHTWjUj5c0DJ5FezvXeFfjqghEQ

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uNnRXWkFCRTJ1R1c1NDJnVXFwRDBWWHhGdEdNeWlTMX5B&google_push=ARnp8GCfBj0E9ky4gmnblpR0sGa8mc2rV6zdpK2lqqnGIUZpZLCjJh_2qB4GhyxO2p6zKV1nLJcmHTWjUj5c0DJ5FezvXeFfjqghEQ
date: Fri, 08 Jul 2022 20:17:44 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B38F 0
12 B 37ms
34ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Iw6uGP_qzhJ1o3JHWxP2VAymnmM_ioohfecoh5-ZzpD8fouuvJ5DB6Mb_tO_Bv9jRxfbUMwg

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 9DB8 15 B
216 B 28ms
28ms Script
text/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=5218&&&vgd_l2type=sca&fp=yzzAfwSZMQYDIuI3H0cMifOjuM6fa10xmptSGrGHiHCOvT1NDe5brbjDToBvPUdqxA_y7Ov2jAbGvxQhmiMSXMZ4B94iaMfRv6-jgioTLM6m3YRri9OiWu9WWlorvDEA&cme=if_ADxXLEU2c5OuvYcemeCCgu0golcX_wJ4ZYY1jHmDu2398qavEKmjaP7qBzKW4pQAeCVMtpYrFS9bZoRWmphhZ6eEUjyN_FcVRNo9mnBtPBamOtDLTd4m1ML5599pfbBsRsR9UfP09l1VSORzeScixjU5xA--doD5t7ZP_KuZmRRqF3m3TxTYY__xEkdX1HFbEZtYLak6QyemaVR-twVLK53zdl6I5QFwx6BYggo0%3D%7C%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7CJwgYdc1KQkFA0AkMtcoUY9olDV92JfOo%7Ca0AmFUYXmD6YYKAfSVuGWyUY6vyv8InEJ2xnHJ5H_0o%3D%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7CfANfNC08TDJOd_WUXpanl5hzjum7_O2OsPTyXfj1idZxlXeMvNwMkP6lymE0dlucaD1aW9DM_o_8YMPBFEJnVlvQssL5SLPjR3-j4BWjq3v_NzNH--vUw7HalD9V9Mm5gyI0S4M5viLgtmIRku97nj8wnhwcYDJCA-H1wFHPt_7HREQAR1f-6i9dqU8jCqVDiPR5GU9TfDeZwDwEktAOq0zbFBWQCSyjNidBZGW58XrOcnz2UpkaeMy95oDJchlpIIwoZAfepoE%3D%7C&v=1&geo=45.5%7C-73.58&lper=100&lpid=&tsid=4&q=&prv=&type=&ps=&hint=&td=&cc=CA&wsip=170721308&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nfu&vgd_fm_lang=EN&vgd_dnquo=00_XX&ksu=224&fdkt=267&vgde_kbbh=fuoyxQBuG&kwd[]=10+Best+Auto+Insurance+Rates&kwt[]=267&kbc[]=56840&kwp[]=1&kid[]=330067967&kbc2[]=56840%7C%7C%7Co_r%3D0.33%7Cp_r%3D0.25%7Cl_r%3D138%7Cc%3D440%7C17%3D7.15%7C18%3D25.38%7C19%3D6.94%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C1%3D4.67%7C2%3D18.43%7Cps%3D0.794%7C3%3D0.74%7C4%3D1.00&ktd[]=274895016704&kwd[]=Top+3+Stocks+to+Buy&kwt[]=375&kbc[]=32871&kwp[]=2&kid[]=321206339&kbc2[]=%23c%3A3473961%7Co_r%3D0.13%7Cp_r%3D0.20%7Cl_r%3D46%7Cc%3D9%7C17%3D2.84%7C18%3D15.86%7C19%3D4.64%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C1%3D0.48%7C2%3D3.65%7Cps%3D0.976%7C3%3D1.24%7C4%3D4.17&ktd[]=1126174818304768&kwd[]=Watch+Live+Online&kwt[]=374&kbc[]=250055&kwp[]=3&kid[]=180959746&kbc2[]=5%3D3266%7C6%3D3%7C16%3D8%7Co_r%3D0.38%7Cp_r%3D0.47%7Cl_r%3D44%7Cc%3D879%7C17%3D11.54%7C18%3D24.49%7C19%3D4.03%7C1%3D0.24%7C2%3D2.02%7C3%3D0.27%7C4%3D3.74&ktd[]=1126174818304512&kwd[]=WordPress+Hosting+Services&kwt[]=374&kbc[]=156583&kwp[]=4&kid[]=316611362&kbc2[]=5%3D9187%7C6%3D2%7C16%3D8%7Co_r%3D0.25%7Cp_r%3D0.17%7Cl_r%3D42%7Cc%3D-127%7C17%3D1.47%7C18%3D8.71%7C19%3D3.37%7C1%3D0.57%7C2%3D6.65%7C3%3D1.75%7C4%3D1.29&ktd[]=1126174801527296&cid=8CU5RJ1PV&vwid=1657311463845468988&vi=1657311463845468988&tdAdd[]=ib%3D0&vsid=3003130611454751&tdAdd[]=asnum%3D16276&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_l3_sc=QC&vgd_chost=contextual.media.net&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_katid=808058573&vgd_katbid=-21&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_kals=ttype%3D10019%7C%7Cpc%3D18%7C%7Cfat%3D1&vgd_kalog=UUID%3Dh8qAYJcEiHxNHTtWE%7C%7CMPTD%3D128%7C%7CSID%3D8%7C%7CTLID%3D6%7C%7CMI%3D2750%7C%7CHID%3D2%7C%7CCI%3D2750%7C%7CTPTD%3D565939267609604%7C%7CSI%3D2750&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170721308&vgd_nrrv=54023&vgd_nrrmf=4848&vgd_nrrsf=scrr&vgd_cty=montreal&vgd_go_pid=8POPGE52H&&vgd_ifrmode=14&vgd_l1rakh=1657311463133227333&sttm=1657311463577&upk=1657311464.27163&hvsid=00001657311463578025035145478352&verid=3111299&vgd_matchstr=hr%3D0%7C&sbdrId=196&vgd_vsidtv=000V10&vgd_ecrid=1700080805857300728009000001000&vgd_isiolc=1&vgd_fcm_enc_mis=1&&kbbq=%26asn%3D16276&&vgd_vstrid=3003130611454751&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.Af~e8QMQOvuii~xLjMLEQMGvi.fF~OmYMGvu~ONfvu~QNOv%20N~eM1QzvuFfhF~OmYMjvf9~ejfLMQOvf9ff9h9W9W~8xLjMGvhuh.uu~xLjM7UNv9~xLjMLf1MGv9~Q7Ov~c0v.*Gjmy.*~j1Q7v~e8QMxLjMGv9.AX~8Evf6%20xQ9~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vAh~LNvH%2CWui~L8Qx8Ov9%2C9~LEQMQOvf9ff9h9WuA~e8QMGvhFu.9W~xLjMGvf.HW~ejfLMxLjMGv9~ejfLMxLjMe8vu49~xLjM7e8vHi~xLjMjvu9~yN17vX9u9ff~GGvuiF~eev9~NejfLMQOvuiF~jfLMGvu999~JLEYv9.Af~ejfLMxLjMUNv949~ejfLMxEMjvf9~GYvu~Q8OvhFHhfHiFh~QOvu~x8OvwWyE0CAbagJ9VGHsu~xLjMLEQMUNv9~NejfLMGvu.ih~G7OvuuhHHAhAWfFfh9XfFuFhXHFXHFFu9HXFAWWf9WAihffWWA9AiffuhAfAFFXhWuifFHAiHAFXhuuXFHW~Nejfvu.iA~AENkvu99u.hu~x8Yv9~OYYMQ7Lyvw1LYmz5~ejfLMxEMGv9~QQvIK~x8Bvou~NJv9~LEQMGvuu9.Wf~xLjMQLEQMGvui.9i~%3DVvfh9f~z7Qvu~c0fv.*Gjmy.*~7Gvou~N7vYmz7LJ1j~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~0sv9~8Q8kv9~jNvu~xLjMLENMGv9~G8Ov9.Af~ONvW~xLjMLEQMLev9~ejfLMGvA.hH~QxEEj5M71yM8Ov~e8JB1G8j875v9.i~1YEvu~NGOEv9.Af9~OYYvw1LYmz5~Qx8Ov%3DK4b44rGGRBa3xyPit_y_rmk4Bc~QyY7vQJyYJz7MGLm1OM7JNwzmjmy5MNmYEx78zy~QOvu~O7NvJ1Q7MQN~-8OvKrtoExGoWFhFXF9XiWfiFFWf~O1jyv~w7Yjvu~1OGjUvuff9F9hHuh~QmGEv9.9u~N7LvX.uWuAHhH4oH~GOEN1EOv9~OYYMJLEYv7LxJ~GkjLv9.9u9~myG8Ov9.Af9~1NM75EJvu~875EJM8Ovuh~QJjjJLM71yM8Ov~1OMGjUMUJ5vuff9F9hHuh~OJ7JN7JOM71yM8Ov~ONx7vA9~OmyGv9ou~8GNvu~OO7vou~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfHh&vgd_optout=0&vgd_cfud=220609&vgd_scsver=258&vgd_go_ent=1&vgd_rensize=728_90&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_dtc=east_sc&vgd_mbr=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A728%3Brend_h%3A90&&vgd_uspa=0&vgd_sc=QC&vgd_l1rhst=contextual.media.net&hvsid=00001657311463578025035145478352&subBdr=196&bdrid=294&rc=0&rand=1657311463998&acid=a5902f4ddc86467d8171c7bce5cb1909&matm=1657311463998&vgd_ltimesrc=1&vgd_ltime=937&vgd_rtime=844&vgd_etm=9&vgd_l1hcsd=O6005%7C4504&vgd_tcf_cmp=1&vgd_l1ch=1&vgd_lhl=2912&vgd_pgid=p1947862235t202207082017&vgd_adprefflag=10&vgd_adpref_diff=100&vgd_csip=rtb-appnexus-7cfb9985db-74jlf.SC&vgd_sbSup=1&vgd_vsidv=10&vgd_nrrs=54023&vgd_cntrdt=SF%7Cb97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5RJ1PV&cpcd=h3e9byNxz1TnUQgxXfdhiw%3D%3D&crid=764724967&size=728x90&cc=CA&chnm=HARMONY&pid=8POPGE52H&tpid=T5KC7JQ&https=1&vif=2&requrl=https%3A%2F%2Fxmod.in%2Fblog&nse=5&vi=1657311463845468988&lw=1&ugd=4&adt1=8CUU9JF8H&adt2=116211091&bae=B4zx/Bge4g&bcpf=B4zx%2FB8fOnRrolnfOur8ge4g&bdrId=294&ntv=0&matchstring=hr%3D0%7C&kttle=SafeFrame%20Container&katpre=1&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&katbid=-21&katid=808058573&kapc=18&ekals=775EJvu99ui%7C%7CENvuW%7C%7Ck17vu&kata=aton&ekalog=PPVrvwW%20K36N48q-Iq_7p4%7C%7Cc0_rvufW%7C%7CbVrvW%7C%7C_TVrvF%7C%7CcVvfhX9%7C%7CqVrvf%7C%7C%3DVvfhX9%7C%7C_0_rvXFXiAifFhF9iF9H%7C%7CbVvfhX9&pgid=p1947862235t202207082017&goent=1&htmlsrc=1&allsc=QC&tcf_cmp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:44 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 08 Jul 2022 20:17:44 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 0424 26 KB
9 KB 35ms
35ms Document
text/html 104.77.8.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.8.25 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

4a34cf7a580b600dbbba734ec62fcb28f479657a859944722e1b1e99ff42e4da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 9326
content-type: text/html; charset=UTF-8
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: Sun, 10 Jul 2022 20:17:44 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 clog
hblg.media.net/ Frame E1D0 35 B
172 B 24ms
22ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/clog?logid=awlog&pixel_len_bucket=5401&ydsp_test_id_1=55&lmt_enf=true&req_mtype%3C%3E=0&mx_nsz=1&spSource=0&ifst=0&vid=YsiQ5wAAepAKh4tTBQzZig&s_city=charleston&ugd=4&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D2%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1%7Ctpi%3D1&app=0&ctr=0.001261034&mx_TAF=2&device_id=4&ae=false&mx_UCC=4&prspt=headerBid&mx_bss_algos%3C%3E=0&usp_status=0&og_cbdp=0.030&size=300x250&mx_TAS=1&mx_gpid_sent=false&xtmax=290&mx_crsw_bckt=A1&commit_id=6ac920ad&scrid=1700080807683300300025000000500&itypeid=17&mx_SPRIG=2&viewability=89&renderer=1&be=0&rtime=9.0&adj0=0.0&tmax=300&s_ip=74.125.78.130&adj2=0.0&adj1=0.0&adtypes=0&mx_aabpc=0&ydsp_bucket_name_1=Control&reqid=YsiQ5wAAepAKh4tTBQzZig&sc=IL&sd=1&mowxReqId=8918e90d3af6406da1fdbe106ea751ad_1&ifdp=0&requrl=https%3A%2F%2Fxmod.in%2Fblog&bidrestime=1657311463100&pv_adtype=0&cc=US&strg=HARMONY&cxtSgmt=segment_broad_technology_computing&pcrid=8CU7Q771E-216119548-28-11&coppa_enf=true&bdp=0.030&ct=Chicago&spIsReq=3&s=1&abs=0%7C0%7Cxtmax%3D290%7CHARMONY%7Cbrr%3D0&mx_epbc=8CU7Q771E&dnt_enf=false&mx_ssBucket=0&vls=0&asn=16276&mang=1&fleet=appnexus&mx_isLossNtf=false&advUrl=https%3A%2F%2Ftopics.businessfocus.online&dn=xmod.in&pgcatiab2=628&dt=O&acid=8918e90d3af6406da1fdbe106ea751ad&actltime=37&act=headerBid&iframingState=0&mx_lr_seg_deal=0&exclattr=32%7C34%7C70%7C13%7C14%7C15%7C16%7C48%7C17%7C114%7C18%7C19%7C20%7C22%7C25%7C26%7C27%7C30&dfpBd=0.017&sckfl=1&dmm_erpm=true&mx_lr=0&mview=1&smbrid=adx-unknown&bfs=103&rfc=-1&prvApiId=8CU7Q771E&epcexp=false&pubid=pub-ADX-116310109131&mx_bsProfile=0&cid=8CUU9JF8H&bcrid=1700080807683300300025000000500&omul=1.0&res_mtype=0&apPrfs%3C%3E=60%23%2315%23%2313%23%2310&suid=CAESEEDbbBwOYugU9XTgTDofEwM&chnl=HARMONY&pst=0&reqsize=300x250&adpos=1&itype=ADX&mx_g_one_uid_sent=None&spCst=0&tgtval=pub-ADX-116310109131&__expireat=1657312063354&lmt_status=N&reftype=3&viewability_vendor=EXCHANGE&prvAccId=216119548&ckfl=0&lper=1&mx_tgs=300x250&cbdp=0.017&pvdTmax=238&ltime=37.0&epc=216119548&ctr_vendor=EXCHANGE&prvReqId=32564407947884_243197021_116211091191&zip=60641&exid=31&spFst=0&mx_GCID=0&cliIPType=v4&pexid=ADX-pub-8676560598296682&brsrclk=0&sbdrid=99&rtttime=59&apTags%3C%3E=75&mx_PC=1&wsip=mowx-lite-7776598566-6l56w&currsrc_date=2022-07-08+00%3A00%3A00&psrc=fail&ydsp_bucket_id_1=205&geoll=false&debug_ts=2022-07-08+20%3A17%3A43&policy_enf=2&mx_ssProfile=0&mx_SC=1&reftime=60&pbidflr=0.010&spbf=0&currsrc=API&fpusp=false&lmt_applied=N&mnrfc=-1&pub_blk_enf=1&amptype=1&moau=true&ocurr=USD&snm=SUCCESS&mx_IAB2=1&usp_enf=1&bidflr=0.010&incentive_type=0&skadidfl=0&pid=8PR113JGC&spTo=3&pvid=9&schain_cmpl=0&is_ortb=false&mx_aurl_hc=0&ucrid_ver=2&mx_maq_call=false&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=1&dbf=1&gdpr=0&gqid=AADH9t-kSx_O4DJvPcGgzL0P-nn67a-Nn1QN-wAFEcu4Jln_1PdY3dJYZPa7Ydw2u_VyMbAU&dmm_ogerpm=false&csip=rtb-appnexus-7cfb9985db-kgx5g.SC&mx_bsBucket=0&mx_aurt=0&mx_crsw_exp=ged&spIvt=3&ptype=23&media=0&smsrc=1&acsn=1&dtc=east_sc&mx_aqcpl_crid=4&ogbdp=0.03&tpbTkn=false&adblk=1921342282&fpuReq=1&vcmplrt=-1.0&crid=116211091&geo_source=2&sat=1&mnet_ckfl=0&mp_seg%3C%3E=44632%23%2360149%23%2344652%23%2344661%23%2344629%23%2361058%23%237688%23%2355664%23%2352765%23%2343988%23%237708%23%2317191%23%237717%23%237685&opbidflr=0.010&impId=1&rme=adm&bdata=~std%3Dna~itype%3DADX~visibility%3D1~city%3DMONTREAL~ref_cnt%3D0~r_ip%3D149.56.153.0~r_sc%3DIL~rbo%3D5_3~bx_rh%3D47DEQpj8HB~bx_asn%3D16276~dmm_d1%3D0~dmm_d2%3DT~dmm_d3%3D0~dmm_d4%3D00~dmm_d5%3D0~dmm_d6%3D0~dmm_d7%3D1~dmm_d8%3D0~dmm_d9%3D0~dmm_d10%3D0~dmm_d11%3D0~dmm_d12%3D1~dmm_d13%3D0~dmm_d14%3D0~dmm_d15%3D1~dmm_d16%3D3~dmm_d17%3D1~dmm_d18%3D85~dmm_d19%3D0001~dmm_d21%3D-1~dmm_d22%3D0.00~dmm_d23%3D0~dmm_d24%3D5~dmm_d25%3Ddef_new~dmm_d26%3D0~dmm_d27%3D0~dmm_d28%3D5~dmm_d29%3D0.00~dmm_d30%3D0~dmm_d32%3D0~dmm_d33%3D0~dmm_d36%3DNA~dmm_d37%3DT~dmm_d40%3D0~dmm_d41%3D0~dmm_d42%3D0~dmm_d43%3D0~dmm_d44%3Dprod~dmm_d45%3D0~dmm_d46%3DR~hc%3D0%20%2B%200~dmm_d51%3D0~dmm_d52%3D0.00~dmm_d53%3D0000~dmm_d56%3D0~sgmt%3Dsegment_broad_technology_computing~bx_rpc%3D0000010~bx_intmd%3D0~bx_ginsu%3D0~bx_cs%3D0~bx_size%3D300x250~bx_l2as%3D0~bx_t_enabled%3D0~bx_t_exp%3D0~bx_exp%3D0~iha%3D0~dmm_l%3D0.007~dmm_r%3D0.629~e_rpm%3D0.043~dmm_m1%3D0.043~dmm_m2%3D0.010~dmm_m3%3D1.000~dmm_m5%3D0.903~dmm_m6%3D0.869~dmm_m7%3D0.845~dmm_m9%3D1.000~dmm_m10%3D1.000~dmm_m11%3D1.000~dmm_m12%3D0.664~dmm_m13%3D1.000~dmm_m14%3D1.000~dmm_m15%3D1.023~dmm_m16%3D0.619~dmm_m17%3D1.000~dmm_m21%3D1.000~dmm_m23%3D1.000~dmm_m24%3D1.000~dmm_m25%3D1.000~dmm_m28%3D1.000~dmm_m29%3D1.000~dmm_m30%3D1.000~dmm_m32%3D0.010~dmm_m33%3D0.126~dmm_m34%3D1.000~dmm_m35%3D112.000~dmm_m36%3D112.000~dmm_m39%3D133.000~dmm_m40%3D133.000~dmm_m43%3D20.410~dmm_m44%3D1.014~dmm_m45%3D191.000~dmm_m46%3D32813.000~dmm_m47%3D248.000~dmm_m48%3D39865.000~dc%3Dgcp-us-east1-d~ck_fl%3D2~bhp%3D0~erpm%3D0.043~vbr%3D0~bid%3D0.030~dmm_d39%3D%2Fbid%2FgetExchangeResponse~supply_tag_id%3D%7Eviewability%3D0.89%7Eamp%3D1%7Ecbdp%3D0.017%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3Ddefault%7Ehtml%3D1%7Eadblk%3D1921342282%7Esobp%3D%7Ectr%3D0.001261034%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D0.030%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D1921342282%7Edetected_tag_id%3D%7Edcut%3D45%7Edogb%3D0-1~ibc%3D1~~mxe%3Dged~mxbn%3DA1&utime=1020&sf=0&cpr=0.9777589206354367
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: max-age=3600
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Apache
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=21600
content-length: 35
expires: Sat, 09 Jul 2022 02:17:44 GMT

GET
H2 200 lt.iframe.html Show response
tags.crwdcntrl.net/lt/shared/2/ Frame E19E 2 KB
1 KB 19ms
18ms Document
text/html 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=15238
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 63cf7a38baaaaebc012cfc355797544949b60c040b5da57560f26d88502d1372

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 4430
cache-control: max-age: 86400
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 19:03:55 GMT
etag: W/"6fcf4f5197ab24c92d090f6ac8d87e01"
last-modified: Mon, 01 Feb 2021 20:35:17 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
x-amz-cf-id: WxJt5pJuOuSl4D7_vdI4KvvWyi8pNwJkm6cjxDxFsWOGTgdYjvi03A==
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5C2A 1 KB
754 B 20ms
19ms Document
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3338
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 19:22:06 GMT
etag: 48472445140208031
expires: Sat, 09 Jul 2022 19:22:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E1D0 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 30415760c794e587404cb8d684b7f9b7410ed2a2764b70bd0bb8ee738bead1b1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6E55 52 KB
17 KB 24ms
23ms Document
text/html 23.221.202.212
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.202.212 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-202-212.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 08 Jul 2022 20:17:44 GMT
ETag: "623de86a-cf34"
Expires: Sat, 09 Jul 2022 20:17:46 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 200
OK iframe Show response
cookie.lmgssp.com/ Frame 9E33 4 KB
2 KB 89ms
19ms Document
text/html 8.2.110.165
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.2.110.165 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: c13c55fc56c60e74e63995e29ac8716bf394ee737f94d0eb8e2cd40e7fa24b97

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Transfer-Encoding: chunked

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame D81D 2 KB
814 B 10ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1657311459877

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9493 15 KB
6 KB 20ms
19ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52835
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame F75F 2 KB
814 B 26ms
24ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=59a18369e249bfb

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame 3454 1 KB
916 B 31ms
31ms Document
text/html 23.227.146.66
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.146.66 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 189e19903b6688e581f5bd3987c7e02bec8b62883d684f8ad3245099d5ad19c3

Request headers

Referer: https://xmod.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://xmod.in
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 621
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H2 204 /
onetag-sys.com/usync/ 0
52 B 11ms
10ms Image
text/plain 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform

GET
H/1.1

200
OK

csync
sync.adtelligent.com/
Redirect Chain

https://ad.360yield.com/server_match?gdpr={gdpr}&gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&r=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D289656%26extuid%3D%7BPUB_USER_ID%7D
https://sync.adtelligent.com/csync?t=a&ep=289656&extuid=65e67f5a-e827-4f35-bc7c-ff637962f11f

0
407 B

18ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=289656&extuid=65e67f5a-e827-4f35-bc7c-ff637962f11f
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

location: https://sync.adtelligent.com/csync?t=a&ep=289656&extuid=65e67f5a-e827-4f35-bc7c-ff637962f11f
date: Fri, 08 Jul 2022 20:17:44 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

csync
sync.adtelligent.com/
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=adtelligent
https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fappnexus%2F2069.44%2F%24UID%3Fzcc%3D0%26sspret%3D1&rndcb=7270198908
https://sync.1rx.io/usersync3/appnexus/2069.44/2840070346914927031?zcc=0&sspret=1&rndcb=7270198908
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D541630%26extuid%3DRX-3e523e7d-41a1-44ba-ae91...
https://sync.adtelligent.com/csync?t=a&ep=541630&extuid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005

0
414 B

32ms
17ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=541630&extuid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://xmod.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: Tengine
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://sync.adtelligent.com/csync?t=a&ep=541630&extuid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Connection: keep-alive
Content-Type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E63E 42 B
64 B 43ms
42ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvHvcWehihPMsYuzSRRBAoa5aA0Su-yRsfXIdJSOKqrI5InLt-yZxEoujL1XrZC3Sy_V5AYU8HBaPHUHImxrHUEhb7AVKqTpfFBWmlCq2kjLpxFjk4uVOFy4OInOVBbBp3n_6I&sai=AMfl-YSRc0DDEzHNT2DwYbym60QY47ocaNMJevh7Hq2UmvYkf8e18je3OZvJkGZeQQEUaOzFVvip98_sx5Ptl7MAT8s5d50EnvJMSF7_TUAXkzUDb2wNlk4ONmq1qXIE&sig=Cg0ArKJSzPbAPzBci40wEAE&cid=CAASJeRod4DLFQItn-D7BbDUwv2KoCnQ1XeK5sNTlHED_DzdP3CKYlk&id=lidar2&mcvt=1085&p=346,650,596,950&mtos=1085,1085,1085,1085,1085&tos=1085,0,0,0,0&v=20220706&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1581293923&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1657311462330&rpt=955&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 404
Not Found cbe1f423d8c67ea338518af42e4fcc89.gif
cs.krushmedia.com/ Frame 9E33 9 B
175 B 268ms
20ms Image
text/plain 8.2.110.134
NATCOWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.krushmedia.com/cbe1f423d8c67ea338518af42e4fcc89.gif?puid=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 8.2.110.134 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/plain

GET
H/1.1

502
Bad Gateway

643.gif
us.cssrvsync.com/ Frame 9E33
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcookie.lmgssp.com%2Fc1a532fd8d6e109a7d6e38cd6a4c3293.gif%3Fpuid%3D%24%24%7BBSW_UUID%7D
https://cookie.lmgssp.com/c1a532fd8d6e109a7d6e38cd6a4c3293.gif?puid=$254dd7d3-92b7-4826-982b-da30ccf966f8
https://us.cssrvsync.com/643.gif?redir=https://sync.aniview.com/cookiesyncendpoint?auid=1649494041627-996430883494-011173-012-002573&biddername=19&key=9aaefe96-316d-40e0-9495-6948a9d26560

0
0

207ms
78ms

Image
text/html

204.11.56.48
CONFLUENCE-NETWOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us.cssrvsync.com/643.gif?redir=https://sync.aniview.com/cookiesyncendpoint?auid=1649494041627-996430883494-011173-012-002573&biddername=19&key=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Server: 204.11.56.48 , Virgin Islands (British), ASN40034 (CONFLUENCE-NETWORK-INC, VG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://us.cssrvsync.com/643.gif?redir=https://sync.aniview.com/cookiesyncendpoint?auid=1649494041627-996430883494-011173-012-002573&biddername=19&key=9aaefe96-316d-40e0-9495-6948a9d26560
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H/1.1

400
Bad Request

merge
ce.lijit.com/ Frame 9E33
Redirect Chain

https://ups.analytics.yahoo.com/ups/58571/occ
https://cookie.lmgssp.com/ec5b89d24941371333ac5f20e86409ab.gif?puid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A
https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff...

0
2 KB

22ms
18ms

Image
text/plain

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Connection: close
X-Sovrn-Pod: ad_ap2ewr1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame 9E33
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8846&redir=https%3A%2F%2Fcookie.lmgssp.com%2Ff83bc2756f87c18fd35dc9670b8d4660.gif%3Fpuid%3D%24SPOTX_USER_ID
https://cookie.lmgssp.com/f83bc2756f87c18fd35dc9670b8d4660.gif?puid=056dad1e-fefb-11ec-bb3f-1df272450503
https://ib.adnxs.com/getuid?https://cookie.lmgssp.com/1f197a5d9efb6d849433724bb397beb3.gif?puid=$UID
https://cookie.lmgssp.com/1f197a5d9efb6d849433724bb397beb3.gif?puid=2840070346914927031
https://sync.inmobi.com/oRTB?redirect=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D&gdpr_consent=[GDPR_CONSENT]&gdpr=[GDPR]
https://id5-sync.com/i/495/0.gif?gdpr_consent=[GDPR_CONSENT]&gdpr=1&callback=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D

43 B
1 KB

98ms
97ms

Image
image/gif

141.95.98.71
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=[GDPR_CONSENT]&gdpr=1&callback=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D

Requested by

Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0

Protocol

HTTP/1.1

Server

141.95.98.71 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

Redirect headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
date: Fri, 08 Jul 2022 20:17:44 GMT
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
x-download-options: noopen
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=[GDPR_CONSENT]&gdpr=1&callback=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D
x-xss-protection: 0
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
vary: Accept
content-length: 191
x-content-type-options: nosniff

GET
H/1.1

400
Bad Request

merge
ce.lijit.com/ Frame 9E33
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fcookie.lmgssp.com%2F5d03e37f652cd64c7dcdb1978f084166.gif%3Fpuid%3D%7Bdevice_id%7D
https://cookie.lmgssp.com/5d03e37f652cd64c7dcdb1978f084166.gif?puid=c200cde8-8ecd-4daa-bb36-66df8263fbd7
https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff...

0
2 KB

19ms
18ms

Image
text/plain

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Connection: close
X-Sovrn-Pod: ad_ap2ewr1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2 200 match
ads.betweendigital.com/ Frame 9E33 68 B
607 B 39ms
26ms Image
image/png 96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=43916&external_user_id=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

GET
H2

200

match
ads.betweendigital.com/ Frame 9E33
Redirect Chain

https://ib.adnxs.com/getuid?https://cookie.lmgssp.com/1f197a5d9efb6d849433724bb397beb3.gif?puid=$UID
https://cookie.lmgssp.com/1f197a5d9efb6d849433724bb397beb3.gif?puid=2840070346914927031
https://ads.betweendigital.com/match?bidder_id=43916&external_user_id=9aaefe96-316d-40e0-9495-6948a9d26560

68 B
607 B

31ms
30ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=43916&external_user_id=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: H2
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://ads.betweendigital.com/match?bidder_id=43916&external_user_id=9aaefe96-316d-40e0-9495-6948a9d26560
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET

usermatchredir
ssum-sec.casalemedia.com/ Frame 9E33
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D
https://cookie.lmgssp.com/6beed97e6e7c580df98d8108c395452d.gif?puid=YsiQ5QpkrhWTB2VNAb45aAAA%26146
https://ssum-sec.casalemedia.com/usermatchredir?s=194301&cb=https%3A%2F%2Fcookie.lmgssp.com%2F6beed97e6e7c580df98d8108c395452d.gif%3Fpuid%3D

0
0

GET
H/1.1 400
Bad Request merge
ce.lijit.com/ Frame 9E33 0
2 KB 26ms
19ms Image
text/plain 23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Connection: close
X-Sovrn-Pod: ad_ap2ewr1
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

404
Not Found

cbe1f423d8c67ea338518af42e4fcc89.gif
cs.krushmedia.com/ Frame 9E33
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-luna-media&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]
https://cookie.lmgssp.com/80640550a22a2d3b1591357016b23eeb.gif?puid=L5CWGBJG-1Y-B9H5&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]
https://sync.search.spotxchange.com/partner?adv_id=8846&redir=https%3A%2F%2Fcookie.lmgssp.com%2Ff83bc2756f87c18fd35dc9670b8d4660.gif%3Fpuid%3D%24SPOTX_USER_ID
https://cookie.lmgssp.com/f83bc2756f87c18fd35dc9670b8d4660.gif?puid=056dad1e-fefb-11ec-bb3f-1df272450503
https://cs.krushmedia.com/cbe1f423d8c67ea338518af42e4fcc89.gif?puid=9aaefe96-316d-40e0-9495-6948a9d26560

9 B
175 B

25ms
23ms

Image
text/plain

8.2.110.134
NATCOWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.krushmedia.com/cbe1f423d8c67ea338518af42e4fcc89.gif?puid=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Server: 8.2.110.134 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/plain

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://cs.krushmedia.com/cbe1f423d8c67ea338518af42e4fcc89.gif?puid=9aaefe96-316d-40e0-9495-6948a9d26560
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame 9E33
Redirect Chain

https://sync.inmobi.com/oRTB?redirect=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D&gdpr_consent=[GDPR_CONSENT]&gdpr=[GDPR]
https://id5-sync.com/i/495/0.gif?gdpr_consent=[GDPR_CONSENT]&gdpr=1&callback=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D

43 B
1 KB

149ms
97ms

Image
image/gif

141.95.98.71
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=[GDPR_CONSENT]&gdpr=1&callback=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D

Requested by

Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0

Protocol

HTTP/1.1

Server

141.95.98.71 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

Redirect headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
date: Fri, 08 Jul 2022 20:17:44 GMT
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
x-download-options: noopen
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=[GDPR_CONSENT]&gdpr=1&callback=https%3A%2F%2Fcookie.lmgssp.com%2Fa184e2218ea9f18e32c70fb304405e72.gif%3Fpuid%3D%7BID5UID%7D
x-xss-protection: 0
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
vary: Accept
content-length: 191
x-content-type-options: nosniff

GET
H2 200 sync
sync-luna.ads.yieldmo.com/sync/ Frame 9E33 43 B
336 B 115ms
25ms Image
image/gif 34.235.48.2
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-luna.ads.yieldmo.com/sync/sync?pn_id=lm&id=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.48.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-48-2.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H/1.1 502
Bad Gateway 643.gif
us.cssrvsync.com/ Frame 9E33 0
0 204ms
67ms Image
text/html 204.11.56.48
CONFLUENCE-NETWOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us.cssrvsync.com/643.gif?redir=https://sync.aniview.com/cookiesyncendpoint?auid=1649494041627-996430883494-011173-012-002573&biddername=19&key=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.11.56.48 , Virgin Islands (British), ASN40034 (CONFLUENCE-NETWORK-INC, VG),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cookie.lmgssp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8CF1 42 B
64 B 48ms
48ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssGowh6VRPC6gKFUYamDaWH3GXb_CgUy4g5qPiJ0QTjeyGUhLp_iXg_ZMVDpmQLSdW9sDNcveiu2eK6ZEiTzBKkKHjoCeElnFBIqgbEdhxj9WIi-ExHs23PI515N1-k9LtmeH8&sai=AMfl-YTKptRjp3xUeYq49rnyumZAlBpLCzP8xUUFxvSSK9TbcfWJ1Ykx210wSxUygeBpOg75__YOmHjVf7psU8u2pCG0_ZyFD-sRC_ENBO0kbCkKiafE-rcL2ctiGlxR&sig=Cg0ArKJSzCRrg4ACKzXoEAE&cid=CAASJeRovMRxGqbf2Fl6YVw0iMgJZuGK9uMU1gA2e-cE9xKOMGK4Kkc&id=lidar2&mcvt=1026&p=1510,436,1600,1164&mtos=713,920,1026,1026,1026&tos=713,207,106,0,0&v=20220706&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2788197179&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1657311461731&rpt=1043&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C2A
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEN60hhIkHVQv74R5wiMVFfI&google_cver=1&google_push=ARnp8GBlI-_tFh5G0RQ1CedyhzT3dciWT5RgtBxsn1yfjzXgeYikH6saHT...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ARnp8GBlI-_tFh5G0RQ1CedyhzT3dciWT5RgtBxsn1yfjzXgeYikH6saHTiWOrCY7g1YeScGytwrYERbtVbT9rqr8wpZxpoCg9ca&google_hm=rYO9Ra...

170 B
188 B

39ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ARnp8GBlI-_tFh5G0RQ1CedyhzT3dciWT5RgtBxsn1yfjzXgeYikH6saHTiWOrCY7g1YeScGytwrYERbtVbT9rqr8wpZxpoCg9ca&google_hm=rYO9Rac8dTPSt68JgfT36g

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ARnp8GBlI-_tFh5G0RQ1CedyhzT3dciWT5RgtBxsn1yfjzXgeYikH6saHTiWOrCY7g1YeScGytwrYERbtVbT9rqr8wpZxpoCg9ca&google_hm=rYO9Rac8dTPSt68JgfT36g
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame 5C2A 43 B
724 B 218ms
200ms Image
image/gif 2606:4700:4400::6812:230b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEJ2TUp1_Sh7N28IdQTFOyCI&google_cver=1&google_push=ARnp8GBx00sMJxY8nq_JG1kptLJvi0nWm9vmgVFvOKSuEGt-D32v6VXbEfMIU38CCBQhAUFK8HJKI7H5rUqQqNtw9uTdjFwR47c&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DARnp8GBx00sMJxY8nq_JG1kptLJvi0nWm9vmgVFvOKSuEGt-D32v6VXbEfMIU38CCBQhAUFK8HJKI7H5rUqQqNtw9uTdjFwR47c%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 727b814ce9437136-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C2A
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEJG19ih6vIbElKc0wSqMkp4&google_cver=1&google_push=ARnp8GAGewIdCEhT4YqmHbWyV_cKtCbcr6PRstx7dzfI4ldrJ77PCsuKK04MOpMR3impVDQq3IfqCL3WjpBH6AGBSq...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7

170 B
188 B

41ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzBiM2U4ZDctY2M5Ny00ODBiLTgwZWUtZGFkNDc2YzM0MWQ3&google_push&gdpr=0&gdpr_consent=&ttd_tdid=70b3e8d7-cc97-480b-80ee-dad476c341d7
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C2A
Redirect Chain

https://sync.extend.tv/r.gif?exchange=googleadx&google_gid=CAESEC-qQsV1ygQ5ET9gDJrt5PI&google_cver=1&google_push=ARnp8GAv_hFlUlJL2aD0GaJ4VD4tA38TYKRO8ky_0G2EUWjhuSoE4Qtg9Qu_PLdodGvrOHGyem3gDoKLg3GB...
https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=ARnp8GAv_hFlUlJL2aD0GaJ4VD4tA38TYKRO8ky_0G2EUWjhuSoE4Qtg9Qu_PLdodGvrOHGyem3gDoKLg3GByxLX0PSfgBEeIy0

170 B
188 B

46ms
43ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=ARnp8GAv_hFlUlJL2aD0GaJ4VD4tA38TYKRO8ky_0G2EUWjhuSoE4Qtg9Qu_PLdodGvrOHGyem3gDoKLg3GByxLX0PSfgBEeIy0

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=ARnp8GAv_hFlUlJL2aD0GaJ4VD4tA38TYKRO8ky_0G2EUWjhuSoE4Qtg9Qu_PLdodGvrOHGyem3gDoKLg3GByxLX0PSfgBEeIy0
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 193
Expires: Tue, 29 May 1984 15:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C2A
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEOlfoPz4vNKRIjKCL1ef2-U&google_cver=1&google_push=ARnp8GA4YRR4mnBdAUzRFG4DDObAYM32YdvVcYLHrQNixkujuOHWOxvGscbKfkrHl5A27SB8L1Xq4D-N9G-EM0WvV8hR8du0OCmy
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ARnp8GA4YRR4mnBdAUzRFG4DDObAYM32YdvVcYLHrQNixkujuOHWOxvGscbKfkrHl5A27SB8L1Xq4D-N9G-EM0WvV8hR8du0OCmy&google_hm=ZzJhZjE3YTQyZTIzZTRi...

170 B
188 B

41ms
38ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ARnp8GA4YRR4mnBdAUzRFG4DDObAYM32YdvVcYLHrQNixkujuOHWOxvGscbKfkrHl5A27SB8L1Xq4D-N9G-EM0WvV8hR8du0OCmy&google_hm=ZzJhZjE3YTQyZTIzZTRiNzE3YzU=

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ARnp8GA4YRR4mnBdAUzRFG4DDObAYM32YdvVcYLHrQNixkujuOHWOxvGscbKfkrHl5A27SB8L1Xq4D-N9G-EM0WvV8hR8du0OCmy&google_hm=ZzJhZjE3YTQyZTIzZTRiNzE3YzU=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5C2A
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESECrM_AZwpIY1lT6tWNDqdiQ&google_cver=1&google_push=ARnp8GC1e4qHBpDdLAmG4lImBE_cYeP-25Qa0b2pGSdOq1PQOePKmaSFJVCkXPw7puJaKXmKJCMEykrW8UECw9m786zHcUHcX4AAlw
https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DARnp8GC1e4qHBpDdLAmG4lImBE_cYeP-25Qa0b2pGSdOq1PQOePKmaSFJVCkXPw7puJa...
https://sync.inmobi.com/gobRedirectFromId5?id=ID5-ZHMOXLmi6UdBjBFGgycEGLlWIKUuN-twQzpwiakINA&google_push=ARnp8GC1e4qHBpDdLAmG4lImBE_cYeP-25Qa0b2pGSdOq1PQOePKmaSFJVCkXPw7puJaKXmKJCMEykrW8UECw9m786zH...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_hm=WuVYJSPPOq6oa1_6Qsqo&google_push=ARnp8GC1e4qHBpDdLAmG4lImBE_cYeP-25Qa0b2pGSdOq1PQOePKmaSFJVCkXPw7puJaKXmKJCMEykrW8UECw9m786zHcU...

170 B
188 B

38ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_hm=WuVYJSPPOq6oa1_6Qsqo&google_push=ARnp8GC1e4qHBpDdLAmG4lImBE_cYeP-25Qa0b2pGSdOq1PQOePKmaSFJVCkXPw7puJaKXmKJCMEykrW8UECw9m786zHcUHcX4AAlw

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
date: Fri, 08 Jul 2022 20:17:44 GMT
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
x-download-options: noopen
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_hm=WuVYJSPPOq6oa1_6Qsqo&google_push=ARnp8GC1e4qHBpDdLAmG4lImBE_cYeP-25Qa0b2pGSdOq1PQOePKmaSFJVCkXPw7puJaKXmKJCMEykrW8UECw9m786zHcUHcX4AAlw
x-xss-protection: 0
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
vary: Accept
content-length: 227
x-content-type-options: nosniff

GET
H2

200

/
onetag-sys.com/match/ Frame 5C2A
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEMeNqAx73A7-NT0YyyNxmUc&google_cver=1&google_push=ARnp8GC303xe9he9Vg-u41bJM15K-acOkajM5mqDtudUzZjWX19Gmf-b32m6lR2uH9VTZRnoCZ7BrGd_vkv...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ARnp8GC303xe9he9Vg-u41bJM15K-acOkajM5mqDtudUzZjWX19Gmf-b32m6lR2uH9VTZRnoCZ7BrGd_vkvLNB9Cu43h7N0WUc5YGw
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

11ms
10ms

Image
text/plain

51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5C2A 0
12 B 41ms
38ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IbXsUM4I4GDc10FTjjtEDX9hkZGn2s0V9UTjmB5XyZ1fJMlgQJHvZcQQ_mg4TxqqCAxXoJ7SU

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 3454
Redirect Chain

https://sync.console.adtarget.com.tr/csync?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D318342%26extuid%3D%7Buid%7D
https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453

0
387 B

22ms
18ms

Image
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: VertaMedia 1.0
Etag: 1b86d3e9a2be5dbf
Content-Length: 0

Redirect headers

Location: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=5af40ae811d41453
Date: Fri, 08 Jul 2022 20:17:43 GMT
Server: VertaMedia 1.0
Etag: 5af40ae811d41453
Content-Length: 0

GET
H2 200 pixels Show response
bcp.crwdcntrl.net/ Frame 350F 1 KB
1 KB 26ms
25ms Document
text/html 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/pixels?s=22%2C106%2C104%2C80%2C78%2C3&c=15238
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=15238
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: fd8ddaaa704e81ff10e3d401c53b326bdce6391d48f8c231e0830ef831f0ea7e

Request headers

Referer: https://tags.crwdcntrl.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache
content-length: 1070
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
pragma: no-cache
server: Jetty(9.4.38.v20210224)
x-server: 10.40.42.124

GET
DATA 200
OK truncated
/ Frame 68E3 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 68E3 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 68E3 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 d6cb57e8eec2fa9c Show response
ads.us.e-planning.net/uspd/1// Frame 44B1 960 B
1 KB 35ms
25ms Document
text/html 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 0e2b9528b534341e1636609753def2efee781a2acb4a3dede6169f56f89ee91d

Request headers

Referer: https://cookie.lmgssp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache
content-length: 960
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: Fri, 08 Jul 2022 20:17:44 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1219

GET
H2

200

/ Show response
de.tynt.com/deb/ Frame 07A2
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X

2 KB
3 KB

35ms
31ms

Document
text/html

67.202.105.32
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.32 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip32.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 9334c7704169c6a94c9ad303b91e720016bf8c4ff39a8cbba09b7e489dbb02eb

Request headers

Referer: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 2143
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8340000A

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 0272 15 KB
6 KB 35ms
28ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156578&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&userIdMacro=9aaefe96-316d-40e0-9495-6948a9d26560&predirect=https%3A%2F%2Fcookie.lmgssp.com%2Fb88c93c8e248435bf25dac741904edd1.gif%3Fpuid%3D%5BUID%5D

Requested by

Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cookie.lmgssp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52835
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 5B8D 2 KB
814 B 16ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=705a6b1ce40ba54

Requested by

Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cookie.lmgssp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 5FF0 9 KB
4 KB 71ms
22ms Document
text/html 52.85.61.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-18.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a8e85d380b3f0593cf9f1b5a8329131112d4cc7a4baf56ad9cbfa31cd3bc41ed

Request headers

Referer: https://cookie.lmgssp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 16007
cache-control: max-age=86400
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 15:50:58 GMT
etag: W/"eb37e18cf286a8e286b2758ea6e68eac"
last-modified: Tue, 28 Jun 2022 00:48:41 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 99b519fb7ca87e7fd6040aacb1160452.cloudfront.net (CloudFront)
x-amz-cf-id: GjjZtBaZK3YCsNlg2mlswtwzy6966voyRb8OERSAwS57jyiYHQ1NLw==
x-amz-cf-pop: EWR53-P1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:04730458-8ed6-4370-aa4e-52547ecd202c
x-amz-meta-codebuild-content-md5: a125e70f379be5f5d28b35ef5ba1d06e
x-amz-meta-codebuild-content-sha256: 859be15d6e78171a31ed0e7d0fe9c672344fe3ce19277e01f8b94f747c41d762
x-cache: Hit from cloudfront

GET
H/1.1 200
OK csync Show response
sync.adtelligent.com/ Frame F732 0
407 B 20ms
18ms Document
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=558003&extuid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr={gdpr]&gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D558003%26extuid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:43 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7FC0 0
28 B 53ms
49ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BT1kV5ZDIYpWcDpL7nwTbkb2YDwAAAAA4AeAEAg&bg=!EhGlEVXNAAaYcLjmuHA7ACkAdvg8WuPJvA6ftNHmjUSD6OSXw3WJu8HOLGHqiR2yzjCr3kOnu5dZPQIAAAMKUgAAAAJoAQeZAuU_sQB09Wa6TtkcwDqTiKDfwxyHSJwQJTFGvf_t1Fv8_fdr9Gg-pgeTXCabDfYeMUBS5brek9JFURVjl-3SDCEGIcNXNwK885XGF3YnWPg18IpkTPqtIlJ-3WVtXnyy4LgPQQzllRYVORzLJVosMmawj8nkOlqfRshsiILmdj7zO2EmYCQ0HXxtFGZXRan_jPjLMgrU1GJJ01anKCO9TA9opY5RDBHsIL5ZrLU781JqGLnC-DWUg-pD1zXFj8INcNjglZxMktWaBz9hPC9fMuXAiXc_QfiQjkpZHVTANBOrhMbg185IKqaAYjn33BpmUCedaqNd9OlLkjFlTFCRtoe-x9vnICWvPSERtG2VsjFinLKQrCq6vneJ-EaezoJ_toUF91miKovQRYrGTYNNiI_V0Xkan_1gxmgxbLIjPbEHCDVtK7_W9Rxzi1i6mxBzNlAxxezQltPivxm5CE7eZZBdu56r2sQq_lwUcvXKLzKJJj5-t3_xp9FaeHk2sGNqqVCe-pMxodCuj5x4bFRlXV8-hEzyVq2LjHxm8DWEYjuateAs53zYb7CVs4hgTecBN4JYCTZVw4ucbfFZbKFCUaD9evbP109mrr6KNDHN6Pm7mj1Fet1qE_mK0Oa4EIHhVOIl9l-vP5721b8jEAPh7yeHmfGHVPcZyXzgNZ1w09V6OTBo5bV_vHZ4lbeY3o0BBlqyhG_OdmVR3CO9YQOiYGHJGZh74LNPQhEe3-60tgSPJ4Szzd5jjow8T2YlfWPZQK6O08YSH3uPia-YnWU2ZjWjW-6-1Qx9MtY5tcbrVPCs1z85N74XMyH67VrA5yD0YVVQ17JD3QVvhJI71B5JCyz58_uKCJEYpy_IbWILgDb76m1aX5ZNaIla5UM8j_2-b7JHzksAke1m6r9k2CWLMdXvW7cNsaQrMsGuB0Al7_95-Me7lUMACPie6Z3BcNRr6lQ5zLzla1LPUqqpusDZXT-5Y-WKodk

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 68E3 15 B
216 B 23ms
22ms Script
text/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=6550&&&vgd_l2type=sca&fp=mXXCGSbyQ00qrx5YVehKVfEwvxntQrFMgWc36skVRdbfTa_AaL5iWikohP2u0E0j4iivSmI693TLeEfWSl7I44OGXbFalvbSNB-ckovpsYqJBi_uQvz4vKypiDnhZBFe&cme=RaW-F_Iv17lfAqsw8UbXWTIk4iaqVc3L07TySjYEYmwHdrG2JarWILKBTkpSAsh2dobka6A67mc8_Gh_wLtRD8XWghV9hXFNYs-0IkUg2iZtuA4OgeFrCczt1vd6T2Umf-EF2ZwXhiCpuxONdqtn3ln0V5n7RwJ00twqOCmitM7EoLExMTPxr-BAkrCyTEOvE71JPSaBfY1RDeF1VLxSqDxs0tog85dy%7C%7C8zufElh5JQEUZhLPlQcYpdSVTQ6KZY90dUnxCe6vhvkKZx-LINDl_60fS_gKFrjK8qZpX7bxUAlcDM7Iv84ei306WyUt5U_3DtbUot1XZC9cGi3LqBq801oq7jF6l-n8IgocapfX7nhKAvWWDFwg0LnYHgHkLVya_9Gbj5w3SnzWGPThvkCEEQsrxfMrvf8tAfMgRa1lT_5wr3cCNcsRN6s9EG5Ld2zWi4ocC-KlrQoECWAzKgghGfiry7sVADRQASM4IuyaIrQ%3D%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7CJwgYdc1KQkFA0AkMtcoUY9olDV92JfOo%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD6YYKAfSVuGWyUY6vyv8InEJ2xnHJ5H_0o%3D%7C&v=1&geo=45.5%7C-73.58&dlper=20&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=&cc=CA&wsip=170721322&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nfu&vgd_dnquo=00_XX&ksu=224&fdkt=267&vgde_kbbh=fuoyxQBuG&kwd[]=10+Best+Auto+Insurance+Rates&kwt[]=267&kbc[]=56840&kwp[]=1&kid[]=330067967&kbc2[]=56840%7C%7C%7C1%3D0.35%7Cc%3D409%7C17%3D8.02%7C18%3D-1%7C19%3D9.54%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C66%3D0.31%7C60%3D0.66%7C62%3D1.21%7C12%3D0.31%7C63%3D0.38%7C10%3D4.15%7Cps%3D0.794%7C3%3D0.74%7C4%3D1.00&ktd[]=274894881536&ktrkt[]=10+Best+Auto+Insurance+Rates&kwd[]=WordPress+Hosting+Services&kwt[]=374&kbc[]=156583&kwp[]=2&kid[]=316611362&kbc2[]=5%3D9187%7C6%3D2%7C16%3D8%7C1%3D0.69%7Co_r%3D0.25%7Cp_r%3D0.17%7Cl_r%3D42%7Cc%3D-157%7C17%3D1.52%7C18%3D-1%7C19%3D4.28%7C66%3D1.08%7C60%3D0.69%7C62%3D0.49%7C12%3D0.45%7C63%3D0.38%7C10%3D4.15%7C3%3D1.75%7C4%3D1.29&ktd[]=1126174801527296&ktrkt[]=WordPress+Hosting+Services&kwd[]=Name+Your+Own+Star&kwt[]=390&kbc[]=208%3A%3A1261621781&kwp[]=3&kid[]=20083796&kbc2[]=5%3D13303%7C6%3D4%7C16%3D22%7C1%3D0.83%7Co_r%3D0.18%7Cp_r%3D0.22%7Cl_r%3D42%7Cc%3D56%7C17%3D5.40%7C18%3D-1%7C19%3D3.79%7C66%3D1.84%7C60%3D0.99%7C62%3D0.29%7C12%3D0.40%7C63%3D0.38%7C10%3D4.15%7C3%3D0.48%7C4%3D2.85&ktd[]=1126174801527296&ktrkt[]=Name+Your+Own+Star&kwd[]=Watch+Live+Online&kwt[]=374&kbc[]=250055&kwp[]=4&kid[]=180959746&kbc2[]=5%3D3266%7C6%3D3%7C16%3D8%7C1%3D0.14%7Co_r%3D0.38%7Cp_r%3D0.47%7Cl_r%3D44%7Cc%3D849%7C17%3D7.60%7C18%3D-1%7C19%3D3.64%7C66%3D2.26%7C60%3D0.14%7C62%3D0.33%7C12%3D0.27%7C63%3D0.38%7C10%3D4.15%7C3%3D0.27%7C4%3D3.74&ktd[]=1126174818304512&ktrkt[]=Watch+Live+Online&kwd[]=Top+3+Stocks+to+Buy&kwt[]=375&kbc[]=32871&kwp[]=5&kid[]=321206339&kbc2[]=%23c%3A3473961%7C1%3D1.87%7Cc%3D-20%7C17%3D2.00%7C18%3D-1%7C19%3D3.25%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C66%3D1.03%7C60%3D1.87%7C62%3D0.45%7C12%3D0.65%7C63%3D0.38%7C10%3D4.15%7Cps%3D0.976%7C3%3D1.45%7C4%3D4.00&ktd[]=1126174818304768&ktrkt[]=Top+3+Stocks+to+Buy&cid=8CU7Q771E&vwid=1657311463537139879&vi=1657311463537139879&tdAdd[]=ib%3D0&vsid=3003130611454751&tdAdd[]=asnum%3D16276&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_l3_sc=QC&vgd_chost=contextual.media.net&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_katbid=-21&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_kals=ttype%3D10019%7C%7Cpc%3D10%7C%7Cfat%3D2%7C%7Ctbft%3D2&vgd_kalog=UUID%3Dh8qAOIuaw4z7OBDtw%7C%7CCI%3D2748%7C%7CSI%3D2750%7C%7CSID%3D8%7C%7CTLID%3D6%7C%7CHID%3D0%7C%7CMPTD%3D128%7C%7CTPTD%3D637957270676484%7C%7CMI%3D2750&vgd_katid=808076833&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170721322&vgd_nrrv=54023&vgd_nrrmf=1ca4a&vgd_nrrsf=scrr&vgd_cty=montreal&vgd_go_pid=8PO6CSQ66&&tdAdd[]=%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=11&vgd_l1rakh=1657311463101446486&sttm=1657311464037&upk=1657311464.3493&hvsid=00001657311464037025035145473327&verid=3111299&sbdrId=99&vgd_vsidtv=000V10&vgd_ecrid=1700080807683300300025000000500&vgd_isiolc=1&vgd_fcm_enc_mis=1&pid=8PO6CSQ66&&abpl=2&&kbbq=%26asn%3D16276&&vgde_ydsp=%7B%227JQ7VOu%22%3A%22XX%22%2C%22GxNUJ7VOu%22%3A%22f9X%22%2C%22GxNUJ7I1YJu%22%3A%22%3Dmz7Lmj%22%7D&&vgd_vstrid=3003130611454751&vgde_bdata=~Q7Ovz1~875EJvKrt~e8Q8G8j875vu~N875vcaI_D4KT~LJkMNz7v9~LM8EvuHi.XF.uXA.9~LMQNvVT~LGmvXMA~G-MLwvHhr4gEdWqR~G-M1QzvuFfhF~OYYMOuv9~OYYMOfv_~OYYMOAv9~OYYMOHv99~OYYMOXv9~OYYMOFv9~OYYMOhvu~OYYMOWv9~OYYMOiv9~OYYMOu9v9~OYYMOuuv9~OYYMOufvu~OYYMOuAv9~OYYMOuHv9~OYYMOuXvu~OYYMOuFvA~OYYMOuhvu~OYYMOuWvWX~OYYMOuiv999u~OYYMOfuvou~OYYMOffv9.99~OYYMOfAv9~OYYMOfHvX~OYYMOfXvOJkMzJB~OYYMOfFv9~OYYMOfhv9~OYYMOfWvX~OYYMOfiv9.99~OYYMOA9v9~OYYMOAfv9~OYYMOAAv9~OYYMOAFvIK~OYYMOAhv_~OYYMOH9v9~OYYMOHuv9~OYYMOHfv9~OYYMOHAv9~OYYMOHHvELmO~OYYMOHXv9~OYYMOHFvD~wNv9n%2Bn9~OYYMOXuv9~OYYMOXfv9.99~OYYMOXAv9999~OYYMOXFv9~QyY7vQJyYJz7MGLm1OM7JNwzmjmy5MNmYEx78zy~G-MLENv99999u9~G-M8z7YOv9~G-My8zQxv9~G-MNQv9~G-MQ8lJvA99-fX9~G-Mjf1Qv9~G-M7MJz1GjJOv9~G-M7MJ-Ev9~G-MJ-Ev9~8w1v9~OYYMjv9.99h~OYYMLv9.Ffi~JMLEYv9.9HA~OYYMYuv9.9HA~OYYMYfv9.9u9~OYYMYAvu.999~OYYMYXv9.i9A~OYYMYFv9.WFi~OYYMYhv9.WHX~OYYMYivu.999~OYYMYu9vu.999~OYYMYuuvu.999~OYYMYufv9.FFH~OYYMYuAvu.999~OYYMYuHvu.999~OYYMYuXvu.9fA~OYYMYuFv9.Fui~OYYMYuhvu.999~OYYMYfuvu.999~OYYMYfAvu.999~OYYMYfHvu.999~OYYMYfXvu.999~OYYMYfWvu.999~OYYMYfivu.999~OYYMYA9vu.999~OYYMYAfv9.9u9~OYYMYAAv9.ufF~OYYMYAHvu.999~OYYMYAXvuuf.999~OYYMYAFvuuf.999~OYYMYAivuAA.999~OYYMYH9vuAA.999~OYYMYHAvf9.Hu9~OYYMYHHvu.9uH~OYYMYHXvuiu.999~OYYMYHFvAfWuA.999~OYYMYHhvfHW.999~OYYMYHWvAiWFX.999~ONvyNEoxQoJ1Q7uoO~NUMkjvf~GwEv9~JLEYv9.9HA~eGLv9~G8Ov9.9A9~OYYMOAivSG8OSyJ74-Nw1zyJDJQEmzQJ~QxEEj5M71yM8Ov~e8JB1G8j875v9.Wi~1YEvu~NGOEv9.9uh~OYYvw1LYmz5~Qx8Ov%3DK4b44rGGRBa3xyPit_y_rmk4Bc~QyY7vQJyYJz7MGLm1OM7JNwzmjmy5MNmYEx78zy~QOvu~O7NvJ1Q7MQN~-8OvKrtoExGoWFhFXF9XiWfiFFWf~O1jyvOJk1xj7~w7Yjvu~1OGjUvuifuAHffWf~QmGEv~N7Lv9.99ufFu9AH~GOEN1EOv9~OYYMJLEYv7LxJ~GkjLv9.9u9~myG8Ov9.9A9~1NM75EJvu~875EJM8Ovuh~QJjjJLM71yM8Ov~1OMGjUMUJ5vuifuAHffWf~OJ7JN7JOM71yM8Ov~ONx7vHX~OmyGv9ou~8GNvu~~Y-JvyJO~Y-GzvKu&vgd_optout=0&vgd_cfud=220331&vgd_scsver=258&vgd_bhv_kbb=-1&vgd_go_ent=1&vgd_l2ch=0&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_dtc=east_sc&vgd_mbr=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250&&vgd_uspa=0&vgd_sc=QC&vgd_l1rhst=contextual.media.net&hvsid=00001657311464037025035145473327&subBdr=99&bdrid=9&rc=0&rand=1657311464478&acid=8918e90d3af6406da1fdbe106ea751ad&matm=1657311464478&requrl=https%3A%2F%2Fxmod.in%2Fblog&vgd_ltimesrc=1&vgd_ltime=699&vgd_rtime=640&vgd_etm=11&vgd_l1hcsd=O6005%7C4504&vgd_tcf_cmp=1&vgd_l1ch=1&vgd_lhl=3669&vgd_pgid=p1947862235t202207082017&vgd_adprefflag=11&vgd_csip=rtb-appnexus-7cfb9985db-kgx5g.SC&vgd_sbSup=1&vgd_vsidv=10&vgd_nrrs=54023&vgd_cntrdt=SF%7Cb97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com&vgd_eadm=1&vgd_end=1

Requested by

Host: xmod.in
URL: https://xmod.in/blog/verify/?ByWXsyM

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:44 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 08 Jul 2022 20:17:44 GMT

GET
H2 200 log
lg3.media.net/ Frame E1D0 35 B
206 B 21ms
20ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/log?logid=kfk&evtid=perf&cid=8CU7Q771E&vi=1657311463537139879&hvsid=00001657311464037025035145473327&l2s_dnsTime=0&l2s_connectionTime=0&l2s_waitTime=254&l2s_downloadTime=5&l2s_total=259&l2s_start=485&l2s_sslTime=0&l2s_nhp=h2&l1s_dnsTime=0&l1s_connectionTime=0&l1s_waitTime=42&l1s_downloadTime=31&l1s_total=73&l1s_start=292&l1s_sslTime=0&l1s_nhp=h2&gdpr=0

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Jetty(9.4.35.v20201120) /

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.35.v20201120)
strict-transport-security: max-age=21600
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:44 GMT

GET
H2 200 um Show response
u-iad04.e-planning.net/ Frame BA8A 42 B
103 B 28ms
27ms Document
image/gif 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://u-iad04.e-planning.net/um?dc=a208d9366469aa64&fi=43c40cadbd39e3cd&uid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D43c40cadbd39e3cd%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-type: image/gif
date: Fri, 08 Jul 2022 20:17:44 GMT
server: openresty

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0358 0
28 B 52ms
51ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B-gkC5ZDIYvnKDqGOjvQP8tOugAUAAAAAOAHgBAI&bg=!_f6l_rrNAAaYcLjmuHA7ACkAdvg8Wle6IFVNwHAg5tvd1aQeKN82KsGgLuAQMvnjcAXDfQl8zTRs0gIAAALgUgAAAANoAQeZAuRaHpOvitCVV-QJZj-so3JCpgpUY9yEUb6qYDpv_FUXyqhJs5ziDy8nJcRWmzbyqa704AY-6zX-aKYBsv7kZfRNPy6TOYZwE0GRe140z-_55xIRTNkm-tuuy1KkanEBH9h_g9vv4vDQil3xaY4S0BX6HLC10KbY0JqA4l5a4VfI7zyMrRSEZfyIbWYeD5R6CqLlnqjkOGk_Eb8eDpeLnD2gmP7usBP1yF8SIyY_RK-tFmbXZpoBOrFw1y9yN7sA9572G6M45polfx3so7i8NhG1r_DXc4wjZAVR2VRNkQIQj9tCoPCxgagJ53XIt3AoPdGuYjJ8jwHy_Gqwz9CX0WcDIgPa-ROUupomaLy8vdmyIn-NXTehTfFezPDGfxpRwlw9oP1I-rMCyrtjNCLB7aETi3qs-f0KMGEQtKnkxf5YOPdI19zJAEHET8CQyyw5RTN6y8toCYpwqhoqxIf2EjXcZjOIqFl_RyuxNZUneisywC-xtrAjSnhFdDszoUh_U2Tc7X9-TqYrfDqlrQ6-33B3BroUGeOJD79eCxamDrCiKDQQN4EnomPgzlvHWDHsBub14Q32r-R55O5TLGGzlojTqk0Fut__Nrhoh-O8l5u2NkKpcedxsZSQHYoOzCWbLuINBm8W__VKBmTipLNMX-3WsXKjysc-zpq20WV_VM0FlYgu59qFjliSxcpWS83Tz6aCyHcPnTC_1sAOS64Pbn0W2T2ozl6IRm1WhEICI9G8gQMv7iBjeOykUOXm1WFJ7dMrGjl_8-vCr5ny7CNHN2RPaj7M68-GDAtSCMW7ka8XmJeAsrLyl8FkC4Rhe9SsK15m5BIAxRVUX00DUAx-uGyLnj4X2DQKaYIq7lDPkEUHm9uEKiqPepdt9KzuEfwUZLHy8NNLAQotzQ_4qOgVWO2bIsTS8b7pKtdc_ORngU-J1aaRR56LlKk4fco_BNyV-kqJLvFVTabYaLEDbwUb93XtgCLXWg

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6E55 0
745 B 42ms
41ms Script
text/html 68.67.160.134
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.134 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: b07b6fce-0dd2-489e-ba84-e44bc5d50057
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK csync Show response
sync.adtelligent.com/ Frame 62DD 0
407 B 21ms
18ms Document
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=558003&extuid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr={gdpr]&gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D558003%26extuid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:43 GMT
Etag: 1b86d3e9a2be5dbf
Server: VertaMedia 1.0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD16 0
28 B 52ms
49ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BMMd55ZDIYs2mDsqknwSpkrjAAgAAAAA4AeAEAg&bg=!paalpuLNAAaYcLjmuHA7ACkAdvg8WmIL6NladWx6FM5skF5qVzS9P9qQ1zqm2ibSSpYKqbfo6HtWpAIAAAJlUgAAAAJoAQeZAvQ69vwQOWwieM4qDYQ3nLpHWQHuKSCw21D6s40b6aJSg_Xhnp1CT7to9PplsjIXGxJgnxZdFN7ePpKMiRZilF2wi5Lsl8Q6drX8MUVSD5rg3mlVr9C31YTVClcmoLFNRDKIvoeZhKKeTXdxQVKk4E8M5j1jTTVfSDKHxMcJPPuG3QT8avg8BShBP0mnD1Ft-QoovsjBDvz0LyITrx2hnacN8jhfWeMu2QDN9T1fndmCQYWM8EluzgIf85GQqpbzZiLe_ILxkUU9Gg5qBmpN5guL7cVRCrKj-9y_2s47mrF4je38Itxt0YUOmCgApC4YPyLr3D3aDudOASi9UdhXFRWFMeuYrJgsNtGGl3fHaH6dQ86h-kE8KSlE71hqWYzmrmdnxgKJ8iW6jIQc2bF39eMII5Q7UyUVtM-RjNGQ3RXOK-uVErt22F4dUvYSSaGU33NLbJTGgX9GLHt4O9KcNAjyzxTexSN8VdPr_WNWlBPKP2AmhCfrSxoNGGET8sP_319mHiW8gBE0dYB4CF0bxv9YxrIhoEw1K_eKMm-7V0KJYZ2XMeN24sdfNxr2qLtAaZaBluPxCkq-zmW-XNvNl10GdFb5ZtQer8kJsYs64Zobrkon8Lpy2GMkDh69VZTQn4wWTY6_-kTLTBNRbhqVFg_bqrDCA2BgqieMtokTmTmRAJSYBZjtecDZgUV0LpuG_ITcCGEpIFh_aQuQflyzElq5lk1kQzPJ_bLvy9W9WeEV1MRwmmFNxG9Ky0tEtDVKqiGLBgztn63Ic_DdU_o9xKJf_A00zqYQSC8-40EMiW_xAFMB37DBPCWyjfkSDqHfHIR02-fY8l4PB2Ra6gkGVRuDa_THOr6pjsGZsWiCmqDwWC6-EUvV6l8Nzr94ILPk5_C8LuAuZERzZNxAhJfmyfr4YUfH1EZkh8eVLv3DeNJJfZcef5wzhdhpV3HVN6d0BS3xjfv95KY5J7qBhH0FxxLr9xAeHguB5_HeLPbwKlJ1mAg8xcQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 350F 170 B
188 B 36ms
36ms Image
image/png 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lotame_dmp&google_hm=M2VkYTIyMGJkNjEzZDlmOTAyZmEyNzVjNmFjM2M3NTE&gdpr=0

Requested by

Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=22%2C106%2C104%2C80%2C78%2C3&c=15238

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

tpid=16b87b44-d75a-4b25-b22b-c79d71265fea
sync.crwdcntrl.net/map/c=10158/tp=TPAD/ Frame 350F
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=LOTAME&partner_device_id=3eda220bd613d9f902fa275c6ac3c751&gdpr=0&partner_url=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10158%2Ftp%3DTPAD%2Ftp...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=16b87b44-d75a-4b25-b22b-c79d71265fea%252Chttps%253A%252F%252Fsync.crwdcntrl.net%252Fmap%252Fc%253D10158%252Ftp%253DTPAD%2...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=70b3e8d7-cc97-480b-80ee-dad476c341d7&ttd_puid=16b87b44-d75a-4b25-b22b-c79d71265fea%2Chttps%3A%2F%2Fsync.crwdcntrl.net%2Fm...
https://sync.crwdcntrl.net/map/c=10158/tp=TPAD/tpid=16b87b44-d75a-4b25-b22b-c79d71265fea

49 B
264 B

27ms
27ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=10158/tp=TPAD/tpid=16b87b44-d75a-4b25-b22b-c79d71265fea
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=22%2C106%2C104%2C80%2C78%2C3&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.44.7
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

location: https://sync.crwdcntrl.net/map/c=10158/tp=TPAD/tpid=16b87b44-d75a-4b25-b22b-c79d71265fea
date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 204 sync.gif
dmp.truoptik.com/f2d2e39fc16bc9cc/ Frame 350F 0
544 B 1089ms
1024ms Image
text/plain 104.16.108.154
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.truoptik.com/f2d2e39fc16bc9cc/sync.gif?cbp=tpid&cbk=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D10832%2Ftp%3DTRUP

Requested by

Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=22%2C106%2C104%2C80%2C78%2C3&c=15238

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.108.154 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
x-content-type-options: nosniff
to-dmp-sync: s2b-dmp-use1-aws.truoptik.com
server: cloudflare
user-agent: Tru Optik DMP 1.3.1
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-origin: *
cache-control: no-store
strict-transport-security: max-age=15552000; includeSubDomains
cf-ray: 727b814eabdb5437-YYZ
cf-cache-status: DYNAMIC
x-xss-protection: 1; mode=block
expires: 0

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 350F 0
337 B 115ms
23ms Image
text/plain 3.89.214.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=lotame&partner_uid=3eda220bd613d9f902fa275c6ac3c751
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=22%2C106%2C104%2C80%2C78%2C3&c=15238
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.89.214.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-89-214-221.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
cache-control: private, no-cache, no-store
x-request-time: D=36 t=1657311464
x-served-by: beacon-n036-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

image.sbxx
ib.mookie1.com/ Frame 350F
Redirect Chain

https://global.ib-ibi.com/image.sbxx?go=262106&pid=420&xid=3eda220bd613d9f902fa275c6ac3c751
https://ib.mookie1.com/image.sbxx?go=262106&pid=420&xid=3eda220bd613d9f902fa275c6ac3c751

120 B
983 B

390ms
85ms

Image
image/png

64.58.232.177
ASN-VINS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.mookie1.com/image.sbxx?go=262106&pid=420&xid=3eda220bd613d9f902fa275c6ac3c751
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=22%2C106%2C104%2C80%2C78%2C3&c=15238
Protocol: HTTP/1.1
Server: 64.58.232.177 , United States, ASN13649 (ASN-VINS, US),
Reverse DNS: be31-199.crrt01.las04.flexential.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 42b601bc0d93dfca6e350b46d113bf8e7ff9e40a87a0c57ab9b3c9c219062423

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3p: CP=\"DSP COR ADM DEV PSA PSD OUR\", CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
X-Server: LAS02
Content-Type: image/png
Content-Length: 120
Expires: -1

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Location: https://ib.mookie1.com:443/image.sbxx?go=262106&pid=420&xid=3eda220bd613d9f902fa275c6ac3c751
p3p: CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin: *
Cache-Control: private
X-Server: LAS16
Content-Type: text/html; charset=utf-8
Content-Length: 217

GET
H2

200

gdpr=0
sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=8147514277513099876/ Frame 350F
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMzQ4ODM4MC90LzI/dpuid/3eda220bd613d9f902fa275c6ac3c751/url/https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=$!%7BTURN_UUID%7D/gdpr=0
https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=8147514277513099876/gdpr=0

49 B
264 B

29ms
28ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=8147514277513099876/gdpr=0
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=22%2C106%2C104%2C80%2C78%2C3&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.6.173
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

location: https://sync.crwdcntrl.net/map/c=10915/tp=TRNN/tpid=8147514277513099876/gdpr=0
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 200 pixels Show response
bcp.crwdcntrl.net/ Frame 4023 1023 B
1 KB 26ms
24ms Document
text/html 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/pixels?s=38%2C12%2C33%2C150%2C2%2C116&c=15238
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=15238
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 58b7e36dd354eebafbd10b07144ce7b0afb8a5a92948ac68066f3b82d6c41228

Request headers

Referer: https://tags.crwdcntrl.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache
content-length: 1023
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
pragma: no-cache
server: Jetty(9.4.38.v20210224)
x-server: 10.40.32.133

GET
H/1.1 200 ptag Show response
a.audrte.com/ Frame 44B1 5 KB
2 KB 26ms
25ms Script
text/plain 54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptag?p=M1353665098
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: bd8ccf8e3f2a53ec9bdbd3582a0a03bb9110fc4b3ad7586c05974cb2af42a953

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-transform, public, max-age=3600
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1682

GET
H2 200 lotame20220615.js Show response
s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/ Frame 44B1 566 B
520 B 26ms
26ms Script
application/x-javascript 172.98.26.121
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.121 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 4f618d20d85f3163d72432606f3afa3c17b6c79954f967ec3df9a710503c9df4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
content-encoding: gzip
last-modified: Wed, 15 Jun 2022 16:21:31 GMT
server: openresty
etag: W/"62aa070b-236"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Wed, 07 Jul 2027 20:17:44 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DCF8 42 B
64 B 35ms
35ms Fetch
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjste8tdmFzWdWxcoyoGzejywvMEnvjV4948eHKGpmt837FfbfIKmx6mNKPI0iC4Mr3EB5E7jVwwfOujWAXrGu3CIMPTE&sig=Cg0ArKJSzI0t9bhQswUkEAE&cid=CAASFeRorhAez3GsqI_RMaEv2_VmIF_PPQ&id=lidar2&mcvt=1048&p=96,650,350,950&mtos=0,1048,1048,1048,1048&tos=0,1048,0,0,0&v=20220706&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&vu=1&app=0&itpl=20&adk=527204189&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1657311462528&rpt=1009&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 6B91 15 KB
6 KB 69ms
68ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3Df62fab110a714a53%26uid%3D

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52835
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 navegg_2022_01_br.html Show response
i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/ Frame 7304 1 KB
987 B 114ms
113ms Document
text/html 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/navegg_2022_01_br.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 Leesburg, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: fda04c7b27b3db6bda165e1d1324e7c475edc1f3cc06e927a78f739d74992fcb

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=157680000
cf4age: 0
cf4ttl: 157680000.000
content-encoding: gzip
content-length: 624
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: W/"61ddbb71-5f5"
expires: Mon, 21 Jun 2027 11:13:51 GMT
last-modified: Tue, 11 Jan 2022 17:16:33 GMT
server: CFS 0215
x-cf-rand: 20.214
x-cf-tsc: 1655896432
x-cf1: 29080:dB.waw1:co:1585621119:cacheN.waw1-01:D
x-cf2: H
x-cf3: M
x-cff: B

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame F0B5 2 KB
814 B 14ms
9ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5927d926323dc2c

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 204 /
spl.zeotap.com/ Frame 938C 0
0 51ms
48ms Document
text/plain 2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 727b814e5ac14bb9-YUL
date: Fri, 08 Jul 2022 20:17:44 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
via: 1.1 google

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 5E8E 15 KB
6 KB 45ms
43ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3DNaN%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D%26us_privacy%3D%24%7BUS_PRIVACY%7D%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52835
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame F882 4 KB
2 KB 97ms
24ms Document
text/html 34.237.228.240
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.228.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-237-228-240.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 80d08350ad89df0ef58a25d68e67180d87e8d4e1d617f37190d230a879bdfab6

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: W/"06c516f03939cf6c66e4b33b210812291"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 3C23 2 KB
814 B 11ms
11ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ec2-52-5-78-75.compute-1.amazonaws.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame D26D 768 B
870 B 105ms
93ms Document
text/html 185.86.137.108
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.108 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 58133f5858a2a0b1aa09909faf35aaf3172b4e667bcc696a16f5dcb4c473417f

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 768
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 2D4F 2 KB
2 KB 79ms
69ms Document
text/html 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0831a69b3d80eec813e3ef501faae1f2bb21150e28d48478ec507bf2fe048c9e

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 727b814ea83053dd-YYZ
content-encoding: br
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
dropped-udsids: 176|18|156|24|191|13|131|230
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jurme7IXB3PQ1G17K%2BbVN5ii7UC0TwnkV0CVqyxY%2Byds4Yaw2snfyj2NmOeCQ%2B8Zl4VyfDyvHnF4hgXSTk1IRkp8YoPbZG5LjcYLChrLh5V7uTT1kS7FCwadain8xG3PzWNeNi%2B8n3gayg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

GET
H/1.1

200
OK

setuid
x.yieldlift.com/ Frame 5FF0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&
https://x.yieldlift.com/setuid?bidder=rubicon&uid=L5CWGBJG-1Y-B9H5&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}

0
570 B

97ms
27ms

Image
application/json

54.85.65.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.yieldlift.com/setuid?bidder=rubicon&uid=L5CWGBJG-1Y-B9H5&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: HTTP/1.1
Server: 54.85.65.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-65-24.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Accept: application/json
Pragma: no-cache
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: application/json;charset=utf-8

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://x.yieldlift.com/setuid?bidder=rubicon&uid=L5CWGBJG-1Y-B9H5&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=2840070346914927031

0
344 B

69ms
24ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=2840070346914927031
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5f3a095f-c6ec-473d-866a-1ab45cedc174
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ads.servenobid.com/sync?pid=310&uid=E8WhbNZHCQrNXmybSwypSL-y

0
351 B

1736ms
1666ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=E8WhbNZHCQrNXmybSwypSL-y
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:46 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=E8WhbNZHCQrNXmybSwypSL-y
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=310&uid=E8WhbNZHCQrNXmybSwypSL-y

0
351 B

64ms
27ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=E8WhbNZHCQrNXmybSwypSL-y
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ads.servenobid.com/sync?pid=310&uid=E8WhbNZHCQrNXmybSwypSL-y
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap3ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://x.yieldlift.com/getuid?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D314%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiNDE0NDUxODItMmRhZi00ZmFiLWJkZTctYzg0Yjg0NmQ4YTRlIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNy0wOFQyMDoxNzo0NC44NTQ2MloifQ==

0
431 B

25ms
24ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiNDE0NDUxODItMmRhZi00ZmFiLWJkZTctYzg0Yjg0NmQ4YTRlIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNy0wOFQyMDoxNzo0NC44NTQ2MloifQ==
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiNDE0NDUxODItMmRhZi00ZmFiLWJkZTctYzg0Yjg0NmQ4YTRlIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNy0wOFQyMDoxNzo0NC44NTQ2MloifQ==
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://match.prod.bidr.io/cookie-sync/ro?rndcb=5419174854
https://sync.1rx.io/usersync/beeswax/AABZSU7FkSIAABCcZS66OQ
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
https://ads.servenobid.com/sync?pid=321&uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005

0
361 B

58ms
44ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=321&uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:45 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: Tengine
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://ads.servenobid.com/sync?pid=321&uid=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Connection: keep-alive
Content-Type: text/html

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=1783777314005288881

0
344 B

96ms
27ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=1783777314005288881
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=1783777314005288881
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
https://ads.servenobid.com/sync?pid=332&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4

0
356 B

60ms
26ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=332&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-117
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ads.servenobid.com/sync?pid=332&uid=3f24516b-6e8b-43e1-a925-de5d7d0fb1c4
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 5FF0
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=
https://prebid.a-mo.net/setuid/magnite?uid=L5CWGBJG-1Y-B9H5&gdpr=0

0
112 B

33ms
25ms

Image
text/plain

145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=L5CWGBJG-1Y-B9H5&gdpr=0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://prebid.a-mo.net/setuid/magnite?uid=L5CWGBJG-1Y-B9H5&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A

0
367 B

69ms
23ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A
date: Fri, 08 Jul 2022 20:17:44 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://sync2.resetdigital.co/csync?pid=durationmedia&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D345%26uid%3DBUYER_USER_ID
https://ads.servenobid.com/sync?pid=345&uid=000000B90B871430

0
342 B

333ms
333ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=345&uid=000000B90B871430
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:48 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:48 GMT
Server: nginx/1.18.0 (Ubuntu)
Front-End-Https: on
Content-Type: text/html
Location: https://ads.servenobid.com/sync?pid=345&uid=000000B90B871430
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://ads.servenobid.com/sync?pid=346&uid=68ecdc9a-5ede-76e6-1a4a-91f847af7cd0

0
356 B

24ms
23ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=346&uid=68ecdc9a-5ede-76e6-1a4a-91f847af7cd0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:45 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=346&uid=68ecdc9a-5ede-76e6-1a4a-91f847af7cd0
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cache-control: no-store
content-length: 0
vary: origin
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 5FF0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ads.servenobid.com/sync?pid=339&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A

0
368 B

68ms
23ms

Image
image/avif

18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: H2
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-8whRqZFE2uGoTTRgNkaYZypCZYXhfq132vQJK2c-~A
date: Fri, 08 Jul 2022 20:17:44 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

400
Bad Request

merge
ce.lijit.com/ Frame 5FF0
Redirect Chain

https://ads.servenobid.com/getsync?redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
https://cookie.lmgssp.com/1146b3293823c26d69cd517211aac923.gif?puid=
https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff...

0
2 KB

57ms
18ms

Image
text/plain

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&usp_consent=${US_PRIVACY}&redirect=https%3A%2F%2Fcookie.lmgssp.com%2F1146b3293823c26d69cd517211aac923.gif%3Fpuid%3D%24UID
Protocol: HTTP/1.1
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Connection: close
X-Sovrn-Pod: ad_ap2ewr1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

POST
H2 200 stream Show response
a3.pubguru.net/ 2 B
347 B 74ms
69ms XHR
text/plain 52.5.78.75
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://a3.pubguru.net/stream?beacon=arinterval

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/v/pg-220518-fa2-nc-86d5133c2abe93c211076929b3bec352.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.5.78.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xmod.in/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
access-control-allow-origin: https://xmod.in
x-frame-options: DENY
content-type: text/plain
x-m2: 1
access-control-expose-headers: X-M2, X-Duration
access-control-allow-credentials: true
x-duration: 45
vary: Origin,Accept-Encoding
x-xss-protection: 1; mode=block

GET
H3

200

cm Show response
us-u.openx.net/w/1.0/ Frame D7A7
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1657311464567.4&ri=70&ru=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fcm%3Fid%3Dc6a5ba0d-ce02-41bd-a1ea-842c68bd5108%26ph%3D8f5ed5d4-642c-4222-968a-d709c...
https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D...

990 B
593 B

46ms
46ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 6c9351ac3265c09c6a5a9494ff3e9d9987c2a31c93e2b7ceeabbfb8e98fa6d32

Request headers

Referer: about:blank
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 574
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 40000000008200000A

GET
H2

200

sync
sync-luna.ads.yieldmo.com/sync/ Frame 07A2
Redirect Chain

https://ssc-cms.33across.com/ps/?_=1657311464567.&ri=0010b00002cmhZGAAY&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D...
https://cookie.lmgssp.com/6a424e7d6bcdc05c505046d4acdf95e4.gif?puid=119241867901331
https://sync-luna.ads.yieldmo.com/sync/sync?pn_id=lm&id=9aaefe96-316d-40e0-9495-6948a9d26560

43 B
335 B

31ms
29ms

Image
image/gif

34.235.48.2
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-luna.ads.yieldmo.com/sync/sync?pn_id=lm&id=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Protocol: H2
Server: 34.235.48.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-48-2.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://sync-luna.ads.yieldmo.com/sync/sync?pn_id=lm&id=9aaefe96-316d-40e0-9495-6948a9d26560
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H3

200

match
events-ssc.33across.com/ Frame 07A2
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1657311464567.2&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A%252...
https://ssum-sec.casalemedia.com/usermatchredir?s=191740&us_privacy=&cb=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D2%26external_user_id%3D
https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=2&external_user_id=YsiQ5QpkrhWTB2VNAb45aAAA%26146

68 B
82 B

35ms
35ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=2&external_user_id=YsiQ5QpkrhWTB2VNAb45aAAA%26146
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YaeCEk5j40mnObVfAn1HfzrGyPvJFNf8%2BIsKG1A3fvRdyJUMfedrS1gZJdTyk2zfDZFpcV5ai8tZ3gSCFCw4RrG8KjzQ7mUYpJvdriMYF71UfXCeaO%2FdvvCoCp0m8WrYi%2B2l%2Br5%2BtoA9lQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=2&external_user_id=YsiQ5QpkrhWTB2VNAb45aAAA%26146
cache-control: no-cache
cf-ray: 727b814f48c353dd-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

match
events-ssc.33across.com/ Frame 07A2
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=104&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D45%26xu%3D%7BuserId%7D
https://ssc-cms.33across.com/ps/?us_privacy=&xi=45&xu=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341
https://events-ssc.33across.com/match?bidder_id=45&external_user_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

42ms
41ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=45&external_user_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=45&external_user_id=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame 07A2
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1657311464567.5&ri=90&ru=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253...
https://ib.adnxs.com/getuid?https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D90%26external_user_id%3D%24UID
https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=90&external_user_id=2840070346914927031

68 B
82 B

48ms
46ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=90&external_user_id=2840070346914927031
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 670.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3bca08a4-e511-48ef-b8b0-843f8896b853
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=90&external_user_id=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame 07A2
Redirect Chain

https://match.deepintent.com/usersync/149?us_privacy=
https://ssc-cms.33across.com/ps/?us_privacy=&xi=75&xu=di_41c964bec1c44a1680959
https://events-ssc.33across.com/match?bidder_id=75&external_user_id=di_41c964bec1c44a1680959&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

42ms
41ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=75&external_user_id=di_41c964bec1c44a1680959&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=75&external_user_id=di_41c964bec1c44a1680959&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame 07A2
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=2c3b95b9-6513-42b2-beb7-260851c73b75&secure=1&us_privacy=&cb=1657311464567.7
https://ssc-cms.33across.com/ps/?xi=66&us_privacy=&xu=fccf1752-8c61-486d-b401-019ae5df932e
https://events-ssc.33across.com/match?bidder_id=66&external_user_id=fccf1752-8c61-486d-b401-019ae5df932e&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

32ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=66&external_user_id=fccf1752-8c61-486d-b401-019ae5df932e&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0010b00002cmhZGAAY&ru=https%3A%2F%2Fcookie.lmgssp.com%2F6a424e7d6bcdc05c505046d4acdf95e4.gif%3Fpuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=66&external_user_id=fccf1752-8c61-486d-b401-019ae5df932e&ts=1657311464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame 4023
Redirect Chain

https://sync.mathtag.com/sync/img?sync=auto&mt_exid=10040&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D4735%26tp%3DMDMA%26tpid%3D%5BMM_UUID%5D%26src=lot%26gdpr%3D0
https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=bea062c8-90e4-4c00-bf77-b3eaa870d307&src=lot&gdpr=0

49 B
263 B

27ms
26ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=bea062c8-90e4-4c00-bf77-b3eaa870d307&src=lot&gdpr=0
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=38%2C12%2C33%2C150%2C2%2C116&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.1.61
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x10 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=bea062c8-90e4-4c00-bf77-b3eaa870d307&src=lot&gdpr=0
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H2 200 5907
tags.bluekai.com/site/ Frame 4023 62 B
451 B 86ms
85ms Image
image/gif 96.16.24.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/5907?limit=0&id=906e1d825ac02a08d128100b24c89492
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=38%2C12%2C33%2C150%2C2%2C116&c=15238
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.16.24.208 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-24-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
content-type: image/gif

GET
H2

200

gdpr=0
sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341/ Frame 4023
Redirect Chain

https://pixel-sync.sitescout.com/connectors/lotame/usersync?gdpr=0&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1389%2Ftp%3DSTSC%2Ftpid%3D%24UUID%2Fgdpr%3D0
https://sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341/gdpr=0

49 B
265 B

32ms
30ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341/gdpr=0
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=38%2C12%2C33%2C150%2C2%2C116&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.42.124
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:43 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://sync.crwdcntrl.net/map/c=1389/tp=STSC/tpid=a5a15de6-7a9e-443f-9e10-d2321a90d3f9-62c890e4-4341/gdpr=0
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 /
wt.rqtrk.eu/ Frame 4023 43 B
350 B 45ms
9ms Image
image/gif 15.235.42.102
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wt.rqtrk.eu/?pid=e34a6063-e846-4ccb-98d8-0eba4dd66b75&src=www&type=100&sid=0&cb=936012026&gdpr=0&gdpr_consent=&gdpr_pd=0&uid=3eda220bd613d9f902fa275c6ac3c751
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=38%2C12%2C33%2C150%2C2%2C116&c=15238
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.235.42.102 , Canada, ASN16276 (OVH, FR),
Reverse DNS: haproxy-ca-001.roqad.pl
Software: istio-envoy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: istio-envoy
p3p: CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
cache-control: no-cache,private
x-envoy-upstream-service-time: 0
content-type: image/gif
content-length: 43
expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H2

200

rand=790539558
sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/ Frame 4023
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D281%2Ftp%3DANXS%2Ftpid%3D%24UID%2Fgdpr%3D0%2Frand=790539558
https://sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/rand=790539558

49 B
265 B

29ms
26ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/rand=790539558
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=38%2C12%2C33%2C150%2C2%2C116&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.32.169
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: f54e8bde-45aa-46d8-ac92-e6c6565baaab
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/rand=790539558
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

gdpr_consent=
sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=70b3e8d7-cc97-480b-80ee-dad476c341d7/gdpr=0/ Frame 4023
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=lotame&ttd_tpi=1&gdpr=0
https://sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=70b3e8d7-cc97-480b-80ee-dad476c341d7/gdpr=0/gdpr_consent=

49 B
264 B

36ms
35ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=70b3e8d7-cc97-480b-80ee-dad476c341d7/gdpr=0/gdpr_consent=
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=38%2C12%2C33%2C150%2C2%2C116&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.11.28
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.crwdcntrl.net/map/c=10620/tp=TRAD/tpid=70b3e8d7-cc97-480b-80ee-dad476c341d7/gdpr=0/gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 249

GET
H2 200 log
hblg.media.net/ Frame DCF8 35 B
194 B 23ms
23ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?log=kfk&evtid=adplog&&lmt_enf=true&req_mtype%3C%3E=0&mx_nsz=1&spSource=0&ifst=0&vid=YsiQ5gACcHwKh7MHKwvEgQ&s_city=charleston&ugd=4&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D2%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1%7Ctpi%3D1&app=0&ctr=0.0016823688&mx_TAF=2&sc_bdp=0.020&device_id=4&ae=false&mx_UCC=4&prspt=headerBid&mx_bss_algos%3C%3E=0&usp_status=0&seat=BID_API&og_cbdp=0.510&size=300x250&mx_TAS=1&mx_gpid_sent=false&xtmax=290&commit_id=6ac920ad&scrid=1700080800126500300025000001000&itypeid=17&mx_SPRIG=2&viewability=78&renderer=1&be=0&rtime=34.0&adj0=0.0&tmax=300&s_ip=74.125.78.130&adj2=0.0&adj1=0.0&adtypes=0&mx_aabpc=0&reqid=YsiQ5gACcHwKh7MHKwvEgQ&sc=IL&sd=1&mowxReqId=801d847da7dc4377ada544c2e5214403_1&ifdp=0&requrl=https%3A%2F%2Fxmod.in%2Fblog&bidrestime=1657311462222&pv_adtype=0&cc=US&strg=HARMONY&cxtSgmt=segment_broad_technology_computing&pcrid=8CU5RJ1PV-845116586-28-18&coppa_enf=true&sc_prspt=headerBid&bdp=0.510&ct=Chicago&spIsReq=3&s=1&abs=0%7C0%7Cxtmax%3D290%7CHARMONY%7Cbrr%3D0&mx_epbc=8CU5RJ1PV&dnt_enf=false&mx_ssBucket=0&vls=0&asn=16276&mang=1&sc_cbdp=0.020&fleet=appnexus&mx_isLossNtf=false&advUrl=https%3A%2F%2Fsearch.yahoo.com&dn=xmod.in&pgcatiab2=628&dt=O&acid=801d847da7dc4377ada544c2e5214403&actltime=44&act=headerBid&iframingState=0&mx_lr_seg_deal=0&exclattr=32%7C34%7C70%7C13%7C14%7C15%7C48%7C16%7C17%7C114%7C18%7C19%7C20%7C22%7C25%7C26%7C27%7C30&dfpBd=0.347&sckfl=1&dmm_erpm=true&mx_lr=0&mview=1&smbrid=adx-unknown&bfs=103&rfc=-1&prvApiId=8CU5RJ1PV&epcexp=false&pubid=pub-ADX-116310109131&mx_bsProfile=0&cid=8CUU9JF8H&bcrid=1700080800126500300025000001000&omul=1.0&res_mtype=0&apPrfs%3C%3E=60%23%2315%23%2313%23%2310&suid=CAESEEDbbBwOYugU9XTgTDofEwM&chnl=HARMONY&pst=0&reqsize=300x250&adpos=1&itype=ADX&mx_g_one_uid_sent=None&spCst=0&tgtval=pub-ADX-116310109131&__expireat=1657312062477&lmt_status=N&reftype=3&viewability_vendor=EXCHANGE&prvAccId=845116586&ckfl=0&lper=1&mx_tgs=300x250&cbdp=0.347&sc_advUrl=https%3A%2F%2Ftopics.businessfocus.online&pvdTmax=248&ltime=42.0&epc=845116586&ctr_vendor=EXCHANGE&prvReqId=118135143865769_47895406_11621109112941&zip=60641&exid=31&spFst=0&mx_GCID=0&cliIPType=v4&pexid=ADX-pub-8676560598296682&ybnca_erpm=0.51&brsrclk=0&sbdrid=186&rtttime=55&apTags%3C%3E=75&mx_PC=1&wsip=mowx-lite-7776598566-8cnh2&currsrc_date=2022-07-08+00%3A00%3A00&sc_adj0=0.0&sc_adj1=0.0&sc_adj2=0.0&psrc=fail&geoll=false&debug_ts=2022-07-08+20%3A17%3A42&policy_enf=2&mx_ssProfile=0&mx_SC=0&reftime=60&pbidflr=0.010&spbf=0&currsrc=API&fpusp=false&lmt_applied=N&mnrfc=-1&pub_blk_enf=1&amptype=1&moau=true&ocurr=USD&snm=SUCCESS&mx_IAB2=1&usp_enf=1&bidflr=0.010&sc_ogbdp=0.02&incentive_type=0&skadidfl=0&pid=8PR113JGC&spTo=3&pvid=294&schain_cmpl=0&is_ortb=false&mx_aurl_hc=0&ucrid_ver=2&mx_maq_call=false&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=1&dbf=1&gdpr=0&gqid=AADH9t9am_notI4YjOLVdbQu6JvHv-pesAdNTqmN_jQ8dSgBkVUr85ZJ9PGJODW-NMxp_wX_&dmm_ogerpm=false&csip=rtb-appnexus-7cfb9985db-b5t6w.SC&mx_bsBucket=0&mx_aurt=0&spIvt=3&ptype=23&media=0&smsrc=1&acsn=1&dtc=east_sc&mx_aqcpl_crid=4&ogbdp=0.51&tpbTkn=false&adblk=527204189&fpuReq=1&vcmplrt=-1.0&crid=116211091&geo_source=2&sat=1&mnet_ckfl=0&mp_seg%3C%3E=44632%23%2360149%23%2344652%23%2344661%23%2344629%23%2361058%23%237688%23%2355664%23%2352765%23%2343988%23%237708%23%2317191%23%237717%23%237685&sc_pvid=319&opbidflr=0.010&impId=1&rme=adm&bdata=sd2%3Dnull~iurl_l%3D20~ogerpm%3D0.51~vis_sd%3D199~url_rps_b%3D6.43~dom_b%3D1~dc2%3D1~scd%3Dqc~v_asn%3D16276~dom_l%3D20~vl2r_sd%3D2022070808~iurl_b%3D717.11~url_tkc%3D9~url_r2a_b%3D0~std%3D~MP%3D.*blog.*~last%3D~vis_url_b%3D0.54~ip%3D2Jqus0~fbb%3D0~vis_url_l%3D30~riipua%3D0%2C0~et%3D33~rc%3D3%2C833~risuid%3D0%2C0~rps_sd%3D2022070813~vis_b%3D580.26~url_b%3D1.39~vl2r_url_b%3D0.02~vl2r_url_vi%3D470~url_tvi%3D466~url_l%3D20~gcat%3D501022~bb%3D186~vv%3D0~cvl2r_sd%3D196~l2r_b%3D1000~erpm%3D0.51~vl2r_url_kc%3D1E1~vl2r_up_l%3D20~bm%3D1~sid%3D845116586~sd%3D1~uid%3Dh8gqLgMIbUNt4LbXL~url_rps_kc%3D1~cvl2r_b%3D3.12~btd%3D942853204152420225907503496055017809800011412901055793140095662623681771212800~cvl2%3D19.72~3pcf%3D1000.31~uim%3D0~dmm_strg%3Dharmony~vl2r_up_b%3D0.02~ss%3DNA~uiw%3D-1~ce%3D0~rps_b%3D135.87~url_srps_b%3D18.34~CI%3D2702~nts%3D1~MP2%3D.*blog.*~tb%3D-1~ct%3Dmontreal~basis2%3D196~basis1%3D196~isRef%3D0~PF%3D0~isif%3D0~lc%3D1~url_rpc_b%3D0~bid%3D0.51~dc%3D8~url_rps_rv%3D0~vl2r_b%3D6.42~supply_tag_id%3D%7Eviewability%3D0.78%7Eamp%3D1%7Ecbdp%3D0.510%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3D%7Ehtml%3D1%7Eadblk%3D527204189%7Esobp%3D0.02%7Ectr%3D0.0016823688%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D0.510%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D527204189%7Edetected_tag_id%3D%7Edcut%3D30%7Edogb%3D0-1~ibc%3D1~ddt%3D-1~nsz%3D1~tgs%3D300x250~bsb%3D0~bsp%3D0~tmx%3D248&utime=1160&sf=0&cpr=0.32419518061527874&evttyp=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:44 GMT

GET
H/1.1

400
Bad Request

merge Show response
ce.lijit.com/ Frame E7FB
Redirect Chain

https://cookie.lmgssp.com/b88c93c8e248435bf25dac741904edd1.gif?puid=[UID]
https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff...

0
2 KB

19ms
19ms

Document
text/plain

23.92.190.68
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156578&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&userIdMacro=9aaefe96-316d-40e0-9495-6948a9d26560&predirect=https%3A%2F%2Fcookie.lmgssp.com%2Fb88c93c8e248435bf25dac741904edd1.gif%3Fpuid%3D%5BUID%5D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Fort Mill, United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Connection: close
Date: Fri, 08 Jul 2022 20:17:44 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ewr1

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Fri, 08 Jul 2022 20:17:44 GMT
Expires: 0
Location: https://ce.lijit.com/merge?pid=87485&3pid=9aaefe96-316d-40e0-9495-6948a9d26560&us_privacy=[CCPA]&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&location=https%3A%2F%2Fcookie.lmgssp.com%2F9e36def72e80a18ff8aef70db891a1e4.gif%3Fpuid%3D%5BUID%5D
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H2 200 lt.min.js Show response
tags.crwdcntrl.net/lt/c/15238/ Frame 44B1 47 KB
15 KB 20ms
20ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Requested by: Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 074691f1175a4040f292124afbff0c87cd24290b7b9672577f33b7c7de205384

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 08 Jul 2022 19:04:01 GMT
content-encoding: gzip
last-modified: Wed, 15 Jun 2022 17:05:13 GMT
server: AmazonS3
age: 4424
etag: W/"a31a707739fd82541fa40e577dbbfede"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
cache-control: max-age: 86400
x-amz-cf-pop: JFK50-P4
x-amz-cf-id: 1ZX3PTNKp4NptItrhbagqbD6IYIZosmMLiuxZenoLHkX7-oe6eC_9g==

GET
H2 200 sirdata_03022021.html Show response
s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/ Frame 7AB0 636 B
577 B 31ms
22ms Document
text/html 172.98.26.121
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.121 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=157680000
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: W/"601b131c-27c"
expires: Wed, 07 Jul 2027 20:17:44 GMT
last-modified: Wed, 03 Feb 2021 21:18:20 GMT
server: openresty

GET
H2

200

sync Show response
sync-luna.ads.yieldmo.com/sync/ Frame 0B1D
Redirect Chain

https://cookie.lmgssp.com/e30bd06e18abf3b2db038d9faf8ee1f5.gif?puid=APHjDxDa7evIVhJZ
https://sync-luna.ads.yieldmo.com/sync/sync?pn_id=lm&id=9aaefe96-316d-40e0-9495-6948a9d26560

43 B
335 B

27ms
27ms

Document
image/gif

34.235.48.2
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-luna.ads.yieldmo.com/sync/sync?pn_id=lm&id=9aaefe96-316d-40e0-9495-6948a9d26560
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1//d6cb57e8eec2fa9c?ruidm=1&du=https%3A%2F%2Fcookie.lmgssp.com%2Fe30bd06e18abf3b2db038d9faf8ee1f5.gif%3Fpuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.48.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-48-2.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
access-control-request-headers: Cache-Control, Pragma
content-length: 43
content-type: image/gif
date: Fri, 08 Jul 2022 20:17:44 GMT
pragma: no-cache

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Fri, 08 Jul 2022 20:17:44 GMT
Expires: 0
Location: https://sync-luna.ads.yieldmo.com/sync/sync?pn_id=lm&id=9aaefe96-316d-40e0-9495-6948a9d26560
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H3

200

crum
dsum.casalemedia.com/ Frame 2D4F
Redirect Chain

https://match.deepintent.com/usersync/113
https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_41c964bec1c44a1680959

43 B
903 B

63ms
58ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_41c964bec1c44a1680959
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81502f97a228-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kj8%2BF2uUCufs8cVWhr5fWH5dpeABEUMuZWUmeXHfG0a2xjgwKv3dX5Bi9wpjN1pb4E%2FINL5DFjgJC5Qlgof3K%2FceNO818sw2pew7KkGaWZXEu%2Fjc%2BYt%2FUAh9jIWifErtw%2FnC%2Bgyw"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_41c964bec1c44a1680959
date: Fri, 08 Jul 2022 20:17:44 GMT
server: a
content-type: image/gif
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 2D4F
Redirect Chain

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1673209065&external_user_id=5fa9d0a4-5e94-44cd-97c3-a616ae7db2fc

43 B
905 B

55ms
54ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1673209065&external_user_id=5fa9d0a4-5e94-44cd-97c3-a616ae7db2fc
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8150b911a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KbNFD8OT46O1lL8jJgwubddym1bVWxgEpfqB58ZtIU0jaGeX%2FBFIvFw1u5k1FcTYxqaTQj7KUiZNfRqF8Cj0Sw9JrpvYvr8GRb1utK9v79R7TcTYN3tdHFWP2FcGQuXzCTKL21bMStKZBA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1673209065&external_user_id=5fa9d0a4-5e94-44cd-97c3-a616ae7db2fc
date: Fri, 08 Jul 2022 20:17:45 GMT
access-control-allow-origin: *.casalemedia.com
content-length: 157
access-control-allow-methods: GET,OPTIONS
content-type: text/html; charset=utf-8

GET
H3

200

crum
dsum.casalemedia.com/ Frame 2D4F
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=fccf1752-8c61-486d-b401-019ae5df932e

43 B
897 B

46ms
46ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=fccf1752-8c61-486d-b401-019ae5df932e
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b81505fc9a228-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ruhqd0K210dnj61cFLSGE8A%2F2G4zq7lbjZlDelfK7Fai2GPaYM12q5rozJ3Ih7L%2BHyW8Cjq3NeiWkLw1pB1yyafZKq5O%2BHIGlmw4shSG8vRzOLh6o%2BOEtMPWzLUxiz0iSPybxMfA"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

X-ServerName: Track003-iad
Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:44 GMT
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=fccf1752-8c61-486d-b401-019ae5df932e
Cache-Control: private,no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 222
Expires: -1

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2D4F
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=c200cde8-8ecd-4daa-bb36-66df8263fbd7&us_privacy=null&gdpr_consent=null&gdpr=null

43 B
905 B

67ms
67ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=c200cde8-8ecd-4daa-bb36-66df8263fbd7&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8150d92fa23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iPMgdMQqpWbclXJMYsq3nv3Ofqqvi4CCATdQPRuUMDggp2HLD39fXrhXwq%2Bec2fWSXYx3S4dEHWQX0fLUqU8Rf8LLPffUDbnToVZJe00hiMImCGWeynqGdhPt0V2UT%2Bj9lNpOBgJCrw3vw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=c200cde8-8ecd-4daa-bb36-66df8263fbd7&us_privacy=null&gdpr_consent=null&gdpr=null
cf-ray: 727b814fff0d7144-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2D4F
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3CIndex_user_id%3E
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=5b987588-56b1-6cdc-83738a9e

43 B
908 B

48ms
48ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=5b987588-56b1-6cdc-83738a9e
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8150b915a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oHDZANvrNFUxXYKb5RJ8UYokUdb5IV6nJTqUDUiqO05perrvIMU1dGCkQGWvZ6Fq%2BFAxeDUS0MA%2FGzRH77GByWbOS6VSjGDoA1y9MlDNcVvVWFXNIGgYbO9Z1Coz0sveOH%2BLmajYkF4Ycg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: nginx/1.22.0
access-control-allow-origin: *
p3p: CP='This is not a P3P policy!'
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=5b987588-56b1-6cdc-83738a9e
cache-control: max-age=3600
content-type: text/html; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 2D4F
Redirect Chain

https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07de220407bfe3f9cd43c48d&expiration=[EXPIRATION]

43 B
910 B

64ms
64ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07de220407bfe3f9cd43c48d&expiration=[EXPIRATION]
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8156af85a23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7n%2Bdxd4eVucFo%2F4neiRILI831M87aUsdkQeCQuWhiQ86PfhBLKgf%2BjAEsRtWGGVS8f1ebDV%2BqFPRzuz4yLiYXHhuwR6wOyuEDYMGDUgNU6BSRF3VTuVHclUuI2d8j%2B12ZOv5ovEBzW2U4g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07de220407bfe3f9cd43c48d&expiration=[EXPIRATION]
Date: Fri, 08 Jul 2022 20:17:20 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Powered-By: Express
Content-Length: 0
Vary: Origin

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 2D4F
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662295447907240

43 B
908 B

60ms
59ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662295447907240
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b8150b91ba23b-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDhGDEjE%2ByMcqzc6c9GrnAHDbsiPfT%2BWpXs%2F1oWD7X92xIeDRCXUPB8iZmcgV2V3wl3h68xexs4sb1%2BNpZuuJlWImddw1otzG7ckDxYMvZ8epc%2BTq9gT1%2Bs1Ejo3D0bV5jZh980Wi0OPxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 2729
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 727b814fffa37136-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662295447907240
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 2D4F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_cver=1

43 B
911 B

56ms
49ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 727b815079bd53dd-YYZ
pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gB9akfBChwBAESfhQncMuG%2F4hw8PFBLH%2BCYV7yIOAdUsFHEzuK1%2BnyuqA6KiGjvGroOIq%2Fr7HcA761fy6PSFaumWvu079%2FzG2HmF6lSzMrLoTWHjV6Zfj9RTttmxKAqHik0iAIp9J9Y%2FXg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGqd4kzwVJsrp3iPgLUJNog&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 2D4F 0
356 B 87ms
52ms Image
image/avif 18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YsiQ5QpkrhWTB2VNAb45aAAAAJIAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:45 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=2840070346914927031

35 B
250 B

27ms
26ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=2840070346914927031
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: f6fae295-ca52-436f-b9ab-137d555f2724
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://usersync.gumgum.com/usersync?b=apn&i=2840070346914927031
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_7367933b-9e12-4005-916e-dbd0c2f4c341&gdpr=0&gdpr_consent=&us_privacy=1---
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=254dd7d3-92b7-4826-982b-da30ccf966f8&ssp=gumgum2&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10593803333612056678&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=16b87b44-d75a-4b25-b22b-c79d71265fea&ssp=gumgum2&gdpr_consent=&gdpr=0
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10593803333612056678&ssp=gumgum2&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=212780604206012158671&ssp=gumgum2&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10593803333612056678&ssp=gumgum2&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=bsw&i=254dd7d3-92b7-4826-982b-da30ccf966f8

35 B
250 B

28ms
26ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=254dd7d3-92b7-4826-982b-da30ccf966f8
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=254dd7d3-92b7-4826-982b-da30ccf966f8
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame F882
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28mLyMDuQTxzRWDzNDwnFAhS4wO55L4fpbTI1bVM6LpeDubXWso9Z-trlXKy59DM4m%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_7367933b-9e12-4005-916e-dbd0c2f4c341&obuid=ENC(mLyMDuQTxzRWDzNDwnFAhS4wO55L4fpbTI1bVM6LpeDubXWso9Z-trlXKy59DM4m)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://match.adsrvr.org/track/cmf/generic?ttd_pid=icco6m5&ttd_tpi=1$CMP
https://sync.outbrain.com/cookie-sync?p=ttd&uid=70b3e8d7-cc97-480b-80ee-dad476c341d7

0
306 B

20ms
20ms

Image
text/plain

64.202.112.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=ttd&uid=70b3e8d7-cc97-480b-80ee-dad476c341d7
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 64.202.112.63 Harrodsburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: no-cache
X-TraceId: aa334adae434f98454946226cebbe2ed
Content-Length: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=ttd&uid=70b3e8d7-cc97-480b-80ee-dad476c341d7
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 199

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=4d991ad6-efea-0dd3-26b0-e139f2450276

35 B
250 B

137ms
27ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=4d991ad6-efea-0dd3-26b0-e139f2450276
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 08 Jul 2022 20:17:44 GMT
content-encoding: gzip
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usersync.gumgum.com/usersync?b=opx&i=4d991ad6-efea-0dd3-26b0-e139f2450276
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-4eff9513-f568-4bc1-6b59-e0b233b73a1a$ip$149.56.153.179

35 B
250 B

127ms
25ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-4eff9513-f568-4bc1-6b59-e0b233b73a1a$ip$149.56.153.179
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-4eff9513-f568-4bc1-6b59-e0b233b73a1a$ip$149.56.153.179
Date: Fri, 08 Jul 2022 20:17:44 GMT
Connection: keep-alive
Content-Length: 128
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-nyFn2SlE2pfxDZdsJL1EPJau7S0qGnzPjZev~A

35 B
250 B

139ms
28ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-nyFn2SlE2pfxDZdsJL1EPJau7S0qGnzPjZev~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 08 Jul 2022 20:17:44 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://usersync.gumgum.com/usersync?b=oth&i=y-nyFn2SlE2pfxDZdsJL1EPJau7S0qGnzPjZev~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=048a94e9-fefb-11ec-a8b2-218c720e69f3

35 B
250 B

124ms
26ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=048a94e9-fefb-11ec-a8b2-218c720e69f3
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=048a94e9-fefb-11ec-a8b2-218c720e69f3
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 07069198-fefb-11ec-8c44-1b98f5c20928

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=BEB0CAC4A97541B6B5143598ACF44E1F

35 B
250 B

91ms
26ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=BEB0CAC4A97541B6B5143598ACF44E1F
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 varnish
server: nginx
age: 0
location: https://usersync.gumgum.com/usersync?b=snc&i=BEB0CAC4A97541B6B5143598ACF44E1F
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: text/plain
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true
x-varnish: 300571885
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
https://usersync.gumgum.com/usersync?b=dit&i=di_41c964bec1c44a1680959

35 B
250 B

116ms
25ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=dit&i=di_41c964bec1c44a1680959
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=dit&i=di_41c964bec1c44a1680959
date: Fri, 08 Jul 2022 20:17:44 GMT
server: a
content-type: image/gif
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_7367933b-9e12-4005-916e-dbd0c2f4c341&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=jfygCZAsX3_URbCTyFTB&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT22TGPFTUGWSBONMDGX2VKJREGVDZIZKEE...
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=jfygCZAsX3_URbCTyFTB&us_privacy=1---

35 B
250 B

26ms
25ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=jfygCZAsX3_URbCTyFTB&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
P3p: CP="We do not support P3P header."
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=jfygCZAsX3_URbCTyFTB&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=65e67f5a-e827-4f35-bc7c-ff637962f11f

35 B
250 B

120ms
27ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=65e67f5a-e827-4f35-bc7c-ff637962f11f
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=65e67f5a-e827-4f35-bc7c-ff637962f11f
date: Fri, 08 Jul 2022 20:17:44 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://sync.srv.stackadapt.com/sync?nid=95&rndcb=2283793357
https://sync.1rx.io/usersync/stackadapt/0-4eff9513-f568-4bc1-6b59-e0b233b73a1a$ip$149.56.153.179
https://sync.targeting.unrulymedia.com/csync/RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
https://usersync.gumgum.com/usersync?b=rhy&i=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005

35 B
250 B

30ms
27ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=rhy&i=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: Tengine
ETag: RX3e523e7d41a144baae91f1b5b25deb6e005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://usersync.gumgum.com/usersync?b=rhy&i=RX-3e523e7d-41a1-44ba-ae91-f1b5b25deb6e-005
Connection: keep-alive
Content-Type: text/html

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=sctiKjRJymw0&ev=1&pid=558355

35 B
250 B

98ms
26ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=sctiKjRJymw0&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://usersync.gumgum.com/usersync?b=pln&i=sctiKjRJymw0&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-57cd67f859-c76tl
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame F882
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=7234296098854412596

35 B
250 B

91ms
25ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=7234296098854412596
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=7234296098854412596
date: Fri, 08 Jul 2022 20:17:44 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame F882 0
358 B 125ms
96ms Image
image/avif 18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=u_7367933b-9e12-4005-916e-dbd0c2f4c341
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:45 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame D26D 0
344 B 24ms
22ms Image
image/avif 18.213.226.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=7234296098854412596&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.226.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-226-169.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET

/
rtb-csync.smartadserver.com/redir/ Frame D26D
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=750daf85-2f34-41fa-98a2-33a3a8b86ef8&gdpr=0&gdpr_consent=

0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame D26D
Redirect Chain

https://pixel.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=0JYyy9-UNMfLx2jA0pV8xN6XaMLLnGiR0paI0io7

43 B
429 B

921ms
385ms

Image
image/gif

199.187.193.193
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=0JYyy9-UNMfLx2jA0pV8xN6XaMLLnGiR0paI0io7
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 199.187.193.193 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=0JYyy9-UNMfLx2jA0pV8xN6XaMLLnGiR0paI0io7
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 get_user_agent_id
cookie-matching.mediarithmics.com/v1/ Frame D26D 0
86 B 278ms
85ms Image
text/plain 54.36.150.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=smart17&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.36.150.187 Paris, France, ASN16276 (OVH, FR),

Reverse DNS

ip187.ip-54-36-150.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;includeSubDomains;preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:45 GMT
strict-transport-security: max-age=63072000;includeSubDomains;preload

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame D26D
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=c200cde8-8ecd-4daa-bb36-66df8263fbd7&gdpr_consent=null&gdpr=0

43 B
426 B

915ms
66ms

Image
image/gif

199.187.193.193
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=c200cde8-8ecd-4daa-bb36-66df8263fbd7&gdpr_consent=null&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 199.187.193.193 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date: Fri, 08 Jul 2022 20:17:45 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=c200cde8-8ecd-4daa-bb36-66df8263fbd7&gdpr_consent=null&gdpr=0
cf-ray: 727b81501f537144-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H3 200 match
events-ssc.33across.com/ Frame D7A7 68 B
82 B 38ms
36ms Image
image/png 34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=70&external_user_id=cccfb2c8-1974-056a-2dfc-fe043041916f
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D7A7
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=Auggjg3qJoIZuXqFAOtugQzpeocZ4nrUAOgwOm54

43 B
61 B

39ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=Auggjg3qJoIZuXqFAOtugQzpeocZ4nrUAOgwOm54
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=Auggjg3qJoIZuXqFAOtugQzpeocZ4nrUAOgwOm54
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D7A7
Redirect Chain

https://x.bidswitch.net/sync?ssp=openx
https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=openx
https://x.bidswitch.net/sync?dsp_id=188&user_id=Tv-VE_VoS8FrWeCyM7c6GpU4mbM&user_group=1&ssp=openx
https://us-u.openx.net/w/1.0/sd?id=537072968&val=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=

43 B
61 B

42ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072968&val=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: //us-u.openx.net/w/1.0/sd?id=537072968&val=254dd7d3-92b7-4826-982b-da30ccf966f8&gdpr=&gdpr_consent=
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D7A7
Redirect Chain

https://p.rfihub.com/cm?pub=25&in=1
https://us-u.openx.net/w/1.0/sd?id=537073062&val=1783777314005288881

43 B
61 B

46ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073062&val=1783777314005288881
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537073062&val=1783777314005288881
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D7A7
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=472EAFCEE13948B5AAD5A88A32E34BD1

43 B
61 B

42ms
41ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=472EAFCEE13948B5AAD5A88A32E34BD1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: nginx
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=472EAFCEE13948B5AAD5A88A32E34BD1
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Thu, 07 Jul 2022 20:17:44 GMT

GET
H/1.1

200
OK

53233
i6.liadm.com/s/ Frame D7A7
Redirect Chain

https://i.liadm.com/s/57424?bidder_id=206088&bidder_uuid=ba126222-f025-0ff4-034d-0dd2b083c2df
https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=206088&bidder_uuid=ba126222-f025-0ff4-034d-0dd2b083c2df&previous_uuid=34e839836d1b48bf99f183948e57d20a
https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/http://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!{TURN_UUID}
https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=8147514277513099876
https://i6.liadm.com/s/53233?bidder_id=183658&bidder_uuid=8147514277513099876

43 B
419 B

105ms
23ms

Image
image/gif

2600:1f18:444a:4680:94f0:86a5:229d:eb8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/53233?bidder_id=183658&bidder_uuid=8147514277513099876

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D

Protocol

HTTP/1.1

Server

2600:1f18:444a:4680:94f0:86a5:229d:eb8a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/53233?bidder_id=183658&bidder_uuid=8147514277513099876
Date: Fri, 08 Jul 2022 20:17:44 GMT
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame D7A7 43 B
653 B 41ms
28ms Image
image/gif 13.225.214.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212314908&puid=a6265ed8-8833-0e14-2b89-7d5ebad39116
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-117.ewr50.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 94ac78512342d473815908b66b16cd7c.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: EWR50-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: kd6FuzXGpruggP1Og9pScnRWSVplraTHtiL12kqSmrEtUUkUS8kLig==
expires: 0

GET
H3 200 709996.gif
id.rlcdn.com/ Frame D7A7 42 B
60 B 60ms
49ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709996.gif
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 Jul 2022 20:17:44 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3

200

dds
rtb.openx.net/sync/ Frame D7A7
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=ZfI0mm55jKunv71j6Qw5ig==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
64 B

28ms
27ms

Image
image/gif

35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 8cjhpo01sk819rv3ac7jcuuil9ej8hoj

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D7A7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://us-u.openx.net/w/1.0/sd?id=536872786&val=bea062c8-90e4-4c00-bf77-b3eaa870d307

43 B
61 B

39ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=536872786&val=bea062c8-90e4-4c00-bf77-b3eaa870d307
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: MT3 4475 c1dc35a master ord-pixel-x53 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://us-u.openx.net/w/1.0/sd?id=536872786&val=bea062c8-90e4-4c00-bf77-b3eaa870d307
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 08 Jul 2022 20:17:43 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D7A7
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=048a94e9-fefb-11ec-a8b2-218c720e69f3

43 B
61 B

50ms
49ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=048a94e9-fefb-11ec-a8b2-218c720e69f3
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/7f1e280 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 google
server: OXGW/7f1e280
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=048a94e9-fefb-11ec-a8b2-218c720e69f3
Date: Fri, 08 Jul 2022 20:17:44 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 070ad782-fefb-11ec-8c44-1b98f5c20928

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E796 0
28 B 79ms
55ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B30a65ZDIYprtKO-HjvQP9ZOZsAsAAAAAOAHgBAI&bg=!5Oel56PNAAaYcLjmuHA7ACkAdvg8Wp3wlVYfgQcPBWmmVHKBzw1Sf9yIsuvlnDOOqEs6galK9_nhUgIAAAKLUgAAAANoAQcKAAPgDDaZAt6ryn8SQmZVEqRHJYje7pB0wEC9cDm2bes2ivbhaijcUYG-V__Cif7JVDdPLUkQJ0TnJm8uFPXPbBo9cOuxszpj17GHSK7KUqi0j_CLAk-bbrheyiROMdMivOJu-MX_R_6j2FZexgQNfY_hlMWGuYW2xm6XsS594Z91ajhVNZv5Z5te21IzTJdvB6LoeykLdmUZRc7eBIwOdKEZcQUQrtfPP8Dom-1vktPPRnldkA9Ag4PyF7hDcdgJBbZprvQtuXuI9bv2jRdxNLnWh3AWjNsLPt9lk7_dMljFxGL56JaElnXWGJJt8s-l_R9UaVzjE86cO9eYV8ZC5LaznrUw5fTFN14iOA_p_xd7J69SngHwD01KgKIafNEkiJEA7gaBM-aHh1LB4QMh-BlZ6rGS_2MFqlAMoVtNGxJWQVBz2Tcb7JaCu1NmXKCRNGBZkFfs3h2cCfTUD5kozf3TpQ4A3pDu-eOPl-_d7Jj88O7oUCocCCNEP5YvMJzAuMIAFIGHLj9Q6MtHtUc4CG77TzJnXTHNyLFMWnqoNKRJEEl9U9FAZuAtXurGPP_Q1A5WqUtHbj9SypIukK3GoHzaLDLifE8ZT1Y-ts3AodS_kZ3f0V_XlVtJX49CE8aDiUjIpyozeS4qv_YqXVrH_XKoY-n1SMI5i1CgIga4TASugsqV2yjTTV9FJPr5S1LSmNLjgA_dIet9-MfU-9AWO9SZeks4ProCnKSUYVH6pvA54Vayef8uS1AUyl9yqNi6utORd2VXWT_HM5-w4owDbkbYBPARbRwB_xpYIVQ0dSYS1ldbQun0la2PY8guJDfmvbzVwrfoHEopqs1HhFmH3HsgsC4F5ntN53v_zr-zO_AMwUFBN7h2OLsAKbYsAFlqLIV3dS767429m1YG5lsnz3h3B_LlhM_I74Yh0SKq7PjTqXQE23IXSVwal5oRWOXeG05kK89kXP9-1D51QpN9xFt0Nucv1w

Requested by

Host: b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com
URL: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 6345
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=

35 B
250 B

107ms
27ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:45 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:44 GMT
Expires: Fri, 08 Jul 2022 20:17:43 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4475 c1dc35a master ord-pixel-x8 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=bea062c8-90e4-4c00-bf77-b3eaa870d307&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F967
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=atm&i=YsiQ5AAO0ntNvgAo&gdpr=0&gdpr_consent=

35 B
250 B

126ms
26ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=YsiQ5AAO0ntNvgAo&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:45 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Fri, 08 Jul 2022 20:17:44 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=YsiQ5AAO0ntNvgAo&gdpr=0&gdpr_consent=
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-yul12834-YUL
x-timer: S1657311465.977403,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 5C09 170 B
188 B 60ms
38ms Document
image/png 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV83MzY3OTMzYi05ZTEyLTQwMDUtOTE2ZS1kYmQwYzJmNGMzNDE=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-221-203-12.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Fri, 08 Jul 2022 20:17:44 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2A79 15 KB
6 KB 43ms
20ms Document
text/html 23.221.203.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.221.203.12 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=52835
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 09 Jul 2022 10:58:19 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 7CE4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=70b3e8d7-cc97-480b-80ee-dad476c341d7

35 B
250 B

112ms
27ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=70b3e8d7-cc97-480b-80ee-dad476c341d7
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:45 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=70b3e8d7-cc97-480b-80ee-dad476c341d7
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 2C4B
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=emx&i=2840070346914927031brt64371657311461469722af

35 B
250 B

109ms
26ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=emx&i=2840070346914927031brt64371657311461469722af
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:45 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 0
content-type: text/html
date: Fri, 08 Jul 2022 20:17:44 GMT
location: https://usersync.gumgum.com/usersync?b=emx&i=2840070346914927031brt64371657311461469722af

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 69DD
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=YsiQ6cCo5uYAAH53cicAAAAA

35 B
250 B

27ms
25ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=YsiQ6cCo5uYAAH53cicAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:45 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Fri, 08 Jul 2022 20:17:45 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=YsiQ6cCo5uYAAH53cicAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 3
X-SO-Cluster-ID: 15
X-SO-HostName: a-ad40119.dc2p.scaleout.jp
X-SO-IP: 149.56.153.179
X-SO-Key: YsiQ6cCo5uYAAH53cicAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":15,"gdpr":false,"ipv4":"149.56.153.179","key":"YsiQ6cCo5uYAAH53cicAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40119"}
X-SO-LB-Hostname: a-tgng40015.dc2p.scaleout.jp
X-SO-Upstream-ID: a-ad40119

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 0A41
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://usersync.gumgum.com/usersync?b=rth&i=tTWIkAlvY1oGbv0lqHgF&pi=gumgum

35 B
250 B

37ms
26ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=tTWIkAlvY1oGbv0lqHgF&pi=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:45 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 08 Jul 2022 20:17:45 GMT Fri, 08 Jul 2022 20:17:45 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=tTWIkAlvY1oGbv0lqHgF&pi=gumgum
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 41C8
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

20ms
18ms

Document
text/html

23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Jul 2022 20:17:45 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 08 Jul 2022 20:17:44 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 um Show response
u-iad04.e-planning.net/ Frame FD74 42 B
103 B 25ms
24ms Document
image/gif 172.98.26.126
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://u-iad04.e-planning.net/um?dc=a208d9366469aa64&fi=f62fab110a714a53&uid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3Df62fab110a714a53%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.126 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-type: image/gif
date: Fri, 08 Jul 2022 20:17:44 GMT
server: openresty

GET
H/1.1 200
OK setuid Show response
x.yieldlift.com/ Frame 0515 0
702 B 25ms
23ms Document
application/json 54.85.65.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://x.yieldlift.com/setuid?bidder=pubmatic&gdpr=NaN&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&uid=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3DNaN%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D%26us_privacy%3D%24%7BUS_PRIVACY%7D%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.65.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-65-24.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept: application/json
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: application/json;charset=utf-8
Expires: 0
Pragma: no-cache

GET
H/1.1 200
OK GS.d Show response
js.cookieless-data.com/ Frame 7AB0 0
535 B 98ms
98ms Script
text/plain 51.158.29.13
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.158.29.13 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

51-158-29-13.rev.poneytelecom.eu

Software

nginx/1.20.2 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains; preload
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: nginx/1.20.2
Strict-Transport-Security: max-age=15724800; includeSubDomains; preload
P3p: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 0
X-Xss-Protection: 0
Expires: Tue, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 41C8 31 KB
10 KB 21ms
20ms Script
text/html 23.1.200.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-1-200-83.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4a411ecc4f2769a81a8f2fc5a796ae019bbaa0ca05aa70ef91d7029e6a3f54b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=50000
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9455
Expires: Sat, 09 Jul 2022 10:11:05 GMT

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame F94E 35 B
250 B 44ms
25ms Document
image/gif 3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=E614708A-96BB-452C-8A92-C68CD106CB31
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 08 Jul 2022 20:17:45 GMT
Expires: 0
Pragma: no-cache

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 5D21 0
128 B 20ms
20ms Script
text/plain 104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=158810&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 08 Jul 2022 20:17:43 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 bqi.php
lg3.media.net/ Frame DCF8 15 B
15 B 33ms
33ms Image
text/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=2437&lf=3&&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_l2type=sca&gdpr=0&prid=8PRN625DH&cid=8CU5RJ1PV&crid=845116586&requrl=https%3A%2F%2Fxmod.in%2Fblog&vi=1657311463271061731&ugd=4&cc=CA&sc=QC&bdrid=294&subBdr=186&startTime=1657311463199&l2type=sca&vgd_l1rakh=1657311462190909608&l1ch=1&sttm=1657311463206&upk=1657311463.26179&hvsid=00001657311463206025035145478280&acid=801d847da7dc4377ada544c2e5214403&verid=3111299&vgd_bdata=sd2%3Dnull~iurl_l%3D20~ogerpm%3D0.51~vis_sd%3D199~url_rps_b%3D6.43~dom_b%3D1~dc2%3D1~scd%3Dqc~v_asn%3D16276~dom_l%3D20~vl2r_sd%3D2022070808~iurl_b%3D717.11~url_tkc%3D9~url_r2a_b%3D0~std%3D~MP%3D.*blog.*~last%3D~vis_url_b%3D0.54~ip%3D2Jqus0~fbb%3D0~vis_url_l%3D30~riipua%3D0%2C0~et%3D33~rc%3D3%2C833~risuid%3D0%2C0~rps_sd%3D2022070813~vis_b%3D580.26~url_b%3D1.39~vl2r_url_b%3D0.02~vl2r_url_vi%3D470~url_tvi%3D466~url_l%3D20~gcat%3D501022~bb%3D186~vv%3D0~cvl2r_sd%3D196~l2r_b%3D1000~erpm%3D0.51~vl2r_url_kc%3D1E1~vl2r_up_l%3D20~bm%3D1~sid%3D845116586~sd%3D1~uid%3Dh8gqLgMIbUNt4LbXL~url_rps_kc%3D1~cvl2r_b%3D3.12~btd%3D942853204152420225907503496055017809800011412901055793140095662623681771212800~cvl2%3D19.72~3pcf%3D1000.31~uim%3D0~dmm_strg%3Dharmony~vl2r_up_b%3D0.02~ss%3DNA~uiw%3D-1~ce%3D0~rps_b%3D135.87~url_srps_b%3D18.34~CI%3D2702~nts%3D1~MP2%3D.*blog.*~tb%3D-1~ct%3Dmontreal~basis2%3D196~basis1%3D196~isRef%3D0~PF%3D0~isif%3D0~lc%3D1~url_rpc_b%3D0~bid%3D0.51~dc%3D8~url_rps_rv%3D0~vl2r_b%3D6.42~supply_tag_id%3D%7Eviewability%3D0.78%7Eamp%3D1%7Ecbdp%3D0.510%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3D%7Ehtml%3D1%7Eadblk%3D527204189%7Esobp%3D0.02%7Ectr%3D0.0016823688%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D0.510%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D527204189%7Edetected_tag_id%3D%7Edcut%3D30%7Edogb%3D0-1~ibc%3D1~ddt%3D-1~nsz%3D1~tgs%3D300x250~bsb%3D0~bsp%3D0~tmx%3D248&matchstring=hr%3D0%7C&vgd_matchstr=hr%3D0%7C&vgd_sc=QC&vstrid=3003130611454751&vgd_vsidv=10&vsidtv=000V10&infr=1&twna=1&stime=1657311462974&vgd_ecrid=1700080800126500300025000001000&l1hcsd=l1!O6005|4504&vgd_l1rhst=contextual.media.net&vgd_uspa=0&vgd_isiolc=1&pvl=%7B%22dtc%22%3A%22east_sc%22%2C%22mbr%22%3A1%2C%22l1rpth%22%3A%22%2Fnmedianet.js%22%2C%22pgids%22%3A1%7D&vgd_fcm_enc_mis=1&vgd_pgid=p1947862235t202207082017&vgd_pgids=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 08 Jul 2022 20:17:45 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 08 Jul 2022 20:17:45 GMT

GET
H/1.1 200 ptrack Show response
a.audrte.com/ Frame 44B1 368 B
880 B 74ms
28ms XHR
text/plain 54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptrack?arlocation=149.56.153.179&p=M1353665098&artime=2022-07-08T20:17:45.203Z&arlocation=YWRzLnVzLmUtcGxhbm5pbmcubmV0L3VzcGQvMS8vZDZjYjU3ZThlZWMyZmE5Yz9ydWlkbT0xJmR1PWh0dHBzJTNBJTJGJTJGY29va2llLmxtZ3NzcC5jb20lMkZlMzBiZDA2ZTE4YWJmM2IyZGIwMzhkOWZhZjhlZTFmNS5naWYlM0ZwdWlkJTNEJTI0VUlE&gdpr=0&gdpr_consent=null&gdpr_version=1&arreferer=Y29va2llLmxtZ3NzcC5jb20v
Requested by: Host: a.audrte.com
URL: https://a.audrte.com/ptag?p=M1353665098
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 7a603ace62a54010863269bef6304e1ab384cb587a5efad0b531b5ee25b8220c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: https://ads.us.e-planning.net
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 263

GET
H2 200 optimus_rules.json Show response
tags.crwdcntrl.net/lt/c/15238/ Frame 44B1 155 B
629 B 18ms
17ms XHR
application/json 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/15238/optimus_rules.json
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1b92260a400bea230772ccfff1953fbe65deeb30da1a8aa146342d20833f24ff

Request headers

Referer: https://ads.us.e-planning.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 08 Jul 2022 19:04:02 GMT
via: 1.1 c3e66686bc7ab6e675ee9210e15097b6.cloudfront.net (CloudFront)
age: 4424
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 155
last-modified: Wed, 15 Jun 2022 17:05:13 GMT
server: AmazonS3
etag: "1a1722e9cedbdc8af0dcd3345e46c73a"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: max-age: 86400
x-amz-cf-pop: JFK50-P4
accept-ranges: bytes
x-amz-cf-id: _nFRbXg9SnSy4JbjqenKLFR7KZ6Vc1_LfGWPr65I6StfAyT27oN7aA==

POST
H2 200 data Show response
bcp.crwdcntrl.net/6/ Frame 44B1 141 B
1009 B 165ms
165ms XHR
application/json 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/data
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 444fa239888490eaf16b8d6d827865cddb7c5898c47b95721c078ac218bd4023

Request headers

Referer: https://ads.us.e-planning.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://ads.us.e-planning.net
cache-control: no-cache
x-server: 10.40.36.60
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 141
expires: 0

GET
H/1.1

200

p
a.audrte.com/ Frame 44B1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=&google_gid=CAESEHmWZqJfwGeylKuche3ULRQ&google_cver=1
https://a.audrte.com/p

68 B
617 B

37ms
26ms

Image
image/png

54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

p
a.audrte.com/ Frame 44B1
Redirect Chain

https://dmp.adform.net/serving/cookie/match/?party=1003&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=7517899671563583421
https://a.audrte.com/p

68 B
617 B

49ms
24ms

Image
image/png

54.81.10.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Server: 54.81.10.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-10-167.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK pixel
ps.eyeota.net/ Frame 44B1 1 KB
1 KB 288ms
288ms Image
application/javascript 52.55.144.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel?pid=kh51m51&t=ajs&uid=gblkSCb19GLRPOJDFrMoNzqNA&gdpr=0&gdpr_consent=
Requested by: Host: cookie.lmgssp.com
URL: https://cookie.lmgssp.com/iframe?pbjs=1&coppa=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 08 Jul 2022 20:17:45 GMT
Content-Type: application/javascript
Content-Length: 1189
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2 200 log
hblg.media.net/ Frame E1D0 35 B
194 B 37ms
37ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?log=kfk&evtid=adplog&&ydsp_test_id_1=55&lmt_enf=true&req_mtype%3C%3E=0&mx_nsz=1&spSource=0&ifst=0&vid=YsiQ5wAAepAKh4tTBQzZig&s_city=charleston&ugd=4&exp=sfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Cclt%3D2%7Cfl_rl%3D1%7CssProfile%3D0%7Cdbr%3D1%7Ctpi%3D1&app=0&ctr=0.001261034&mx_TAF=2&device_id=4&ae=false&mx_UCC=4&prspt=headerBid&mx_bss_algos%3C%3E=0&usp_status=0&og_cbdp=0.030&size=300x250&mx_TAS=1&mx_gpid_sent=false&xtmax=290&mx_crsw_bckt=A1&commit_id=6ac920ad&scrid=1700080807683300300025000000500&itypeid=17&mx_SPRIG=2&viewability=89&renderer=1&be=0&rtime=9.0&adj0=0.0&tmax=300&s_ip=74.125.78.130&adj2=0.0&adj1=0.0&adtypes=0&mx_aabpc=0&ydsp_bucket_name_1=Control&reqid=YsiQ5wAAepAKh4tTBQzZig&sc=IL&sd=1&mowxReqId=8918e90d3af6406da1fdbe106ea751ad_1&ifdp=0&requrl=https%3A%2F%2Fxmod.in%2Fblog&bidrestime=1657311463100&pv_adtype=0&cc=US&strg=HARMONY&cxtSgmt=segment_broad_technology_computing&pcrid=8CU7Q771E-216119548-28-11&coppa_enf=true&bdp=0.030&ct=Chicago&spIsReq=3&s=1&abs=0%7C0%7Cxtmax%3D290%7CHARMONY%7Cbrr%3D0&mx_epbc=8CU7Q771E&dnt_enf=false&mx_ssBucket=0&vls=0&asn=16276&mang=1&fleet=appnexus&mx_isLossNtf=false&advUrl=https%3A%2F%2Ftopics.businessfocus.online&dn=xmod.in&pgcatiab2=628&dt=O&acid=8918e90d3af6406da1fdbe106ea751ad&actltime=37&act=headerBid&iframingState=0&mx_lr_seg_deal=0&exclattr=32%7C34%7C70%7C13%7C14%7C15%7C16%7C48%7C17%7C114%7C18%7C19%7C20%7C22%7C25%7C26%7C27%7C30&dfpBd=0.017&sckfl=1&dmm_erpm=true&mx_lr=0&mview=1&smbrid=adx-unknown&bfs=103&rfc=-1&prvApiId=8CU7Q771E&epcexp=false&pubid=pub-ADX-116310109131&mx_bsProfile=0&cid=8CUU9JF8H&bcrid=1700080807683300300025000000500&omul=1.0&res_mtype=0&apPrfs%3C%3E=60%23%2315%23%2313%23%2310&suid=CAESEEDbbBwOYugU9XTgTDofEwM&chnl=HARMONY&pst=0&reqsize=300x250&adpos=1&itype=ADX&mx_g_one_uid_sent=None&spCst=0&tgtval=pub-ADX-116310109131&__expireat=1657312063354&lmt_status=N&reftype=3&viewability_vendor=EXCHANGE&prvAccId=216119548&ckfl=0&lper=1&mx_tgs=300x250&cbdp=0.017&pvdTmax=238&ltime=37.0&epc=216119548&ctr_vendor=EXCHANGE&prvReqId=32564407947884_243197021_116211091191&zip=60641&exid=31&spFst=0&mx_GCID=0&cliIPType=v4&pexid=ADX-pub-8676560598296682&brsrclk=0&sbdrid=99&rtttime=59&apTags%3C%3E=75&mx_PC=1&wsip=mowx-lite-7776598566-6l56w&currsrc_date=2022-07-08+00%3A00%3A00&psrc=fail&ydsp_bucket_id_1=205&geoll=false&debug_ts=2022-07-08+20%3A17%3A43&policy_enf=2&mx_ssProfile=0&mx_SC=1&reftime=60&pbidflr=0.010&spbf=0&currsrc=API&fpusp=false&lmt_applied=N&mnrfc=-1&pub_blk_enf=1&amptype=1&moau=true&ocurr=USD&snm=SUCCESS&mx_IAB2=1&usp_enf=1&bidflr=0.010&incentive_type=0&skadidfl=0&pid=8PR113JGC&spTo=3&pvid=9&schain_cmpl=0&is_ortb=false&mx_aurl_hc=0&ucrid_ver=2&mx_maq_call=false&mx_uid_sent=0&mx_sbp=-10.0&mnrf=0&slotVisibility=1&dbf=1&gdpr=0&gqid=AADH9t-kSx_O4DJvPcGgzL0P-nn67a-Nn1QN-wAFEcu4Jln_1PdY3dJYZPa7Ydw2u_VyMbAU&dmm_ogerpm=false&csip=rtb-appnexus-7cfb9985db-kgx5g.SC&mx_bsBucket=0&mx_aurt=0&mx_crsw_exp=ged&spIvt=3&ptype=23&media=0&smsrc=1&acsn=1&dtc=east_sc&mx_aqcpl_crid=4&ogbdp=0.03&tpbTkn=false&adblk=1921342282&fpuReq=1&vcmplrt=-1.0&crid=116211091&geo_source=2&sat=1&mnet_ckfl=0&mp_seg%3C%3E=44632%23%2360149%23%2344652%23%2344661%23%2344629%23%2361058%23%237688%23%2355664%23%2352765%23%2343988%23%237708%23%2317191%23%237717%23%237685&opbidflr=0.010&impId=1&rme=adm&bdata=~std%3Dna~itype%3DADX~visibility%3D1~city%3DMONTREAL~ref_cnt%3D0~r_ip%3D149.56.153.0~r_sc%3DIL~rbo%3D5_3~bx_rh%3D47DEQpj8HB~bx_asn%3D16276~dmm_d1%3D0~dmm_d2%3DT~dmm_d3%3D0~dmm_d4%3D00~dmm_d5%3D0~dmm_d6%3D0~dmm_d7%3D1~dmm_d8%3D0~dmm_d9%3D0~dmm_d10%3D0~dmm_d11%3D0~dmm_d12%3D1~dmm_d13%3D0~dmm_d14%3D0~dmm_d15%3D1~dmm_d16%3D3~dmm_d17%3D1~dmm_d18%3D85~dmm_d19%3D0001~dmm_d21%3D-1~dmm_d22%3D0.00~dmm_d23%3D0~dmm_d24%3D5~dmm_d25%3Ddef_new~dmm_d26%3D0~dmm_d27%3D0~dmm_d28%3D5~dmm_d29%3D0.00~dmm_d30%3D0~dmm_d32%3D0~dmm_d33%3D0~dmm_d36%3DNA~dmm_d37%3DT~dmm_d40%3D0~dmm_d41%3D0~dmm_d42%3D0~dmm_d43%3D0~dmm_d44%3Dprod~dmm_d45%3D0~dmm_d46%3DR~hc%3D0%20%2B%200~dmm_d51%3D0~dmm_d52%3D0.00~dmm_d53%3D0000~dmm_d56%3D0~sgmt%3Dsegment_broad_technology_computing~bx_rpc%3D0000010~bx_intmd%3D0~bx_ginsu%3D0~bx_cs%3D0~bx_size%3D300x250~bx_l2as%3D0~bx_t_enabled%3D0~bx_t_exp%3D0~bx_exp%3D0~iha%3D0~dmm_l%3D0.007~dmm_r%3D0.629~e_rpm%3D0.043~dmm_m1%3D0.043~dmm_m2%3D0.010~dmm_m3%3D1.000~dmm_m5%3D0.903~dmm_m6%3D0.869~dmm_m7%3D0.845~dmm_m9%3D1.000~dmm_m10%3D1.000~dmm_m11%3D1.000~dmm_m12%3D0.664~dmm_m13%3D1.000~dmm_m14%3D1.000~dmm_m15%3D1.023~dmm_m16%3D0.619~dmm_m17%3D1.000~dmm_m21%3D1.000~dmm_m23%3D1.000~dmm_m24%3D1.000~dmm_m25%3D1.000~dmm_m28%3D1.000~dmm_m29%3D1.000~dmm_m30%3D1.000~dmm_m32%3D0.010~dmm_m33%3D0.126~dmm_m34%3D1.000~dmm_m35%3D112.000~dmm_m36%3D112.000~dmm_m39%3D133.000~dmm_m40%3D133.000~dmm_m43%3D20.410~dmm_m44%3D1.014~dmm_m45%3D191.000~dmm_m46%3D32813.000~dmm_m47%3D248.000~dmm_m48%3D39865.000~dc%3Dgcp-us-east1-d~ck_fl%3D2~bhp%3D0~erpm%3D0.043~vbr%3D0~bid%3D0.030~dmm_d39%3D%2Fbid%2FgetExchangeResponse~supply_tag_id%3D%7Eviewability%3D0.89%7Eamp%3D1%7Ecbdp%3D0.017%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3Ddefault%7Ehtml%3D1%7Eadblk%3D1921342282%7Esobp%3D%7Ectr%3D0.001261034%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D0.030%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D1921342282%7Edetected_tag_id%3D%7Edcut%3D45%7Edogb%3D0-1~ibc%3D1~~mxe%3Dged~mxbn%3DA1&utime=1020&sf=0&cpr=0.9777589206354367&evttyp=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-167-93.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b97f05b36eb4f0e6fbe7537c413565f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 08 Jul 2022 20:17:45 GMT

GET
H2 200 lt.iframe.html Show response
tags.crwdcntrl.net/lt/shared/2/ Frame FC3C 2 KB
1 KB 21ms
21ms Document
text/html 108.138.128.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=15238
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 63cf7a38baaaaebc012cfc355797544949b60c040b5da57560f26d88502d1372

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 4431
cache-control: max-age: 86400
content-encoding: gzip
content-type: text/html
date: Fri, 08 Jul 2022 19:03:55 GMT
etag: W/"6fcf4f5197ab24c92d090f6ac8d87e01"
last-modified: Mon, 01 Feb 2021 20:35:17 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
x-amz-cf-id: 3GLbKSKd2oM5cncciD_y36cG1LP5IfeBRqdTMkq06EoAmzJkZ97eqw==
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H2 200 pixels Show response
bcp.crwdcntrl.net/ Frame 3C78 1 KB
1 KB 26ms
25ms Document
text/html 52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/pixels?s=2%2C42%2C153%2C95%2C26%2C94&c=15238
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/shared/2/lt.iframe.html?c=15238
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: d1a1c2c4aabc35efd771e9a29630b06488c8286e0045c2d03b47debc9c85a60f

Request headers

Referer: https://tags.crwdcntrl.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache
content-length: 1033
content-type: text/html
date: Fri, 08 Jul 2022 20:17:45 GMT
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
pragma: no-cache
server: Jetty(9.4.38.v20210224)
x-server: 10.40.32.141

GET
H2

200

rand=336463292
sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/ Frame 3C78
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D281%2Ftp%3DANXS%2Ftpid%3D%24UID%2Fgdpr%3D0%2Frand=336463292
https://sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/rand=336463292

49 B
263 B

28ms
28ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/rand=336463292
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=2%2C42%2C153%2C95%2C26%2C94&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.6.1
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
X-Proxy-Origin: 149.56.153.179; 149.56.153.179; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: f3663688-0624-4634-94d8-93ff7714dc86
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.crwdcntrl.net/map/c=281/tp=ANXS/tpid=2840070346914927031/gdpr=0/rand=336463292
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame 3C78
Redirect Chain

https://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=lotame&AG_REDIR=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D363%26tp%3DADGR%26tpid%3D__AG_UID__%26gdpr%3D0
https://sync.crwdcntrl.net/qmap?c=363&tp=ADGR&tpid=0481e10a-fefb-11ec-99ad-d15aeeec5f47&gdpr=0

49 B
265 B

30ms
29ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=363&tp=ADGR&tpid=0481e10a-fefb-11ec-99ad-d15aeeec5f47&gdpr=0
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=2%2C42%2C153%2C95%2C26%2C94&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.14.148
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
server: Cowboy
Location: https://sync.crwdcntrl.net/qmap?c=363&tp=ADGR&tpid=0481e10a-fefb-11ec-99ad-d15aeeec5f47&gdpr=0
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
X-RealServer-NX: lga-delivery-6
Content-Length: 0
Expires: Thu, 23 Sep 2004 17:42:04 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 3C78 43 B
932 B 31ms
29ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=a8acf3b3-7ede-4e18-8405-edaf41005f97&id=3eda220bd613d9f902fa275c6ac3c751

Requested by

Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=2%2C42%2C153%2C95%2C26%2C94&c=15238

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: DKQ56PYRY4VKWE71Y8C3
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

tpid=84d6c6cf-6a0f-e473-8388-7b37db198cef
bcp.crwdcntrl.net/map/c=10098/tp=SRVT/ Frame 3C78
Redirect Chain

https://px.surveywall-api.survata.com/t
https://bcp.crwdcntrl.net/map/c=10098/tp=SRVT/tpid=84d6c6cf-6a0f-e473-8388-7b37db198cef

49 B
264 B

27ms
27ms

Image
image/gif

52.203.157.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=10098/tp=SRVT/tpid=84d6c6cf-6a0f-e473-8388-7b37db198cef
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=2%2C42%2C153%2C95%2C26%2C94&c=15238
Protocol: H2
Server: 52.203.157.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-157-37.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:46 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.7.231
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Date: Fri, 08 Jul 2022 20:17:46 GMT
ETag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Server: nginx/1.19.2
X-Powered-By: Express
Content-Type: image/gif; charset=utf-8
Location: https://bcp.crwdcntrl.net/map/c=10098/tp=SRVT/tpid=84d6c6cf-6a0f-e473-8388-7b37db198cef
Referer: px.surveywall-api.survata.com, px.surveywall-api.survata.com, px.surveywall-api.survata.com
Connection: keep-alive
Content-Length: 0

GET
H2

200

gdpr=0
sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YsiQ5AAO0ntNvgAo/ Frame 3C78
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/bsTd8NdE?gdpr=0&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1811%2Ftp%3DTBMG%2Ftpid%3D%24%7BTM_USER_ID%7D%2Fgdpr%3D0
https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YsiQ5AAO0ntNvgAo/gdpr=0

49 B
265 B

109ms
108ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YsiQ5AAO0ntNvgAo/gdpr=0
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=2%2C42%2C153%2C95%2C26%2C94&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.47.155
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1657311465.480621,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YsiQ5AAO0ntNvgAo/gdpr=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

gdpr=0
sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=29460562930443400322670570130307594980/ Frame 3C78
Redirect Chain

https://dpm.demdex.net/ibs:dpid=121998&dpuuid=3eda220bd613d9f902fa275c6ac3c751&gdpr=0&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUID%7D%2Fgdpr=0
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=121998&dpuuid=3eda220bd613d9f902fa275c6ac3c751&gdpr=0&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUI...
https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=29460562930443400322670570130307594980/gdpr=0

49 B
265 B

29ms
28ms

Image
image/gif

52.73.102.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=29460562930443400322670570130307594980/gdpr=0
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/pixels?s=2%2C42%2C153%2C95%2C26%2C94&c=15238
Protocol: H2
Server: 52.73.102.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-102-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jul 2022 20:17:45 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.15.154
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

DCS: dcs-prod-va6-1-v036-05074e698.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: eF4k7YN2TAg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=29460562930443400322670570130307594980/gdpr=0
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 41C8
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&us_privacy=1---&khaos=L5CWGBJG-1Y-B9H5
https://usersync.gumgum.com/usersync?b=mag&i=L5CWGBJG-1Y-B9H5&us_privacy=1---

35 B
250 B

28ms
27ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=L5CWGBJG-1Y-B9H5&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 Jul 2022 20:17:45 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://usersync.gumgum.com/usersync?b=mag&i=L5CWGBJG-1Y-B9H5&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H2 200 bqi.php
lg3.media.net/ Frame E1D0 15 B
15 B 59ms
58ms Image
text/javascript 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=3890&lf=3&&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=116211091&vgd_l2type=sca&pid=8PO6CSQ66&kalog=UUID=h8qAOIuaw4z7OBDtw||CI=2748||SI=2750||SID=8||TLID=6||HID=0||MPTD=128||TPTD=637957270676484||MI=2750&kals=ttype=10019||pc=10||fat=2||tbft=2&kasts=tstype=-10408||gbid=-1&kata=aton&katbid=-21&katen=1&katid=808076833&cme=RaW-F_Iv17lfAqsw8UbXWTIk4iaqVc3L07TySjYEYmwHdrG2JarWILKBTkpSAsh2dobka6A67mc8_Gh_wLtRD8XWghV9hXFNYs-0IkUg2iZtuA4OgeFrCczt1vd6T2Umf-EF2ZwXhiCpuxONdqtn3ln0V5n7RwJ00twqOCmitM7EoLExMTPxr-BAkrCyTEOvE71JPSaBfY1RDeF1VLxSqDxs0tog85dy||8zufElh5JQEUZhLPlQcYpdSVTQ6KZY90dUnxCe6vhvkKZx-LINDl_60fS_gKFrjK8qZpX7bxUAlcDM7Iv84ei306WyUt5U_3DtbUot1XZC9cGi3LqBq801oq7jF6l-n8IgocapfX7nhKAvWWDFwg0LnYHgHkLVya_9Gbj5w3SnzWGPThvkCEEQsrxfMrvf8tAfMgRa1lT_5wr3cCNcsRN6s9EG5Ld2zWi4ocC-KlrQoECWAzKgghGfiry7sVADRQASM4IuyaIrQ=|u8A6SM53vAcxkZY9VHWafLSuY-HKDieQ|JwgYdc1KQkFA0AkMtcoUY9olDV92JfOo|dsA6EMpZ47R6ljdz__nQtthZoUpm2bb5|a0AmFUYXmD6YYKAfSVuGWyUY6vyv8InEJ2xnHJ5H_0o=|&gdpr=0&prid=8PRVCXX19&cid=8CU7Q771E&crid=216119548&requrl=https%3A%2F%2Fxmod.in%2Fblog&vi=1657311463537139879&ugd=4&cc=CA&sc=QC&bdrid=9&subBdr=99&startTime=1657311464032&l2type=sca&vgd_l1rakh=1657311463101446486&l1ch=1&sttm=1657311464037&upk=1657311464.3493&hvsid=00001657311464037025035145473327&acid=8918e90d3af6406da1fdbe106ea751ad&verid=3111299&vgd_bdata=~std%3Dna~itype%3DADX~visibility%3D1~city%3DMONTREAL~ref_cnt%3D0~r_ip%3D149.56.153.0~r_sc%3DIL~rbo%3D5_3~bx_rh%3D47DEQpj8HB~bx_asn%3D16276~dmm_d1%3D0~dmm_d2%3DT~dmm_d3%3D0~dmm_d4%3D00~dmm_d5%3D0~dmm_d6%3D0~dmm_d7%3D1~dmm_d8%3D0~dmm_d9%3D0~dmm_d10%3D0~dmm_d11%3D0~dmm_d12%3D1~dmm_d13%3D0~dmm_d14%3D0~dmm_d15%3D1~dmm_d16%3D3~dmm_d17%3D1~dmm_d18%3D85~dmm_d19%3D0001~dmm_d21%3D-1~dmm_d22%3D0.00~dmm_d23%3D0~dmm_d24%3D5~dmm_d25%3Ddef_new~dmm_d26%3D0~dmm_d27%3D0~dmm_d28%3D5~dmm_d29%3D0.00~dmm_d30%3D0~dmm_d32%3D0~dmm_d33%3D0~dmm_d36%3DNA~dmm_d37%3DT~dmm_d40%3D0~dmm_d41%3D0~dmm_d42%3D0~dmm_d43%3D0~dmm_d44%3Dprod~dmm_d45%3D0~dmm_d46%3DR~hc%3D0%20%2B%200~dmm_d51%3D0~dmm_d52%3D0.00~dmm_d53%3D0000~dmm_d56%3D0~sgmt%3Dsegment_broad_technology_computing~bx_rpc%3D0000010~bx_intmd%3D0~bx_ginsu%3D0~bx_cs%3D0~bx_size%3D300x250~bx_l2as%3D0~bx_t_enabled%3D0~bx_t_exp%3D0~bx_exp%3D0~iha%3D0~dmm_l%3D0.007~dmm_r%3D0.629~e_rpm%3D0.043~dmm_m1%3D0.043~dmm_m2%3D0.010~dmm_m3%3D1.000~dmm_m5%3D0.903~dmm_m6%3D0.869~dmm_m7%3D0.845~dmm_m9%3D1.000~dmm_m10%3D1.000~dmm_m11%3D1.000~dmm_m12%3D0.664~dmm_m13%3D1.000~dmm_m14%3D1.000~dmm_m15%3D1.023~dmm_m16%3D0.619~dmm_m17%3D1.000~dmm_m21%3D1.000~dmm_m23%3D1.000~dmm_m24%3D1.000~dmm_m25%3D1.000~dmm_m28%3D1.000~dmm_m29%3D1.000~dmm_m30%3D1.000~dmm_m32%3D0.010~dmm_m33%3D0.126~dmm_m34%3D1.000~dmm_m35%3D112.000~dmm_m36%3D112.000~dmm_m39%3D133.000~dmm_m40%3D133.000~dmm_m43%3D20.410~dmm_m44%3D1.014~dmm_m45%3D191.000~dmm_m46%3D32813.000~dmm_m47%3D248.000~dmm_m48%3D39865.000~dc%3Dgcp-us-east1-d~ck_fl%3D2~bhp%3D0~erpm%3D0.043~vbr%3D0~bid%3D0.030~dmm_d39%3D%2Fbid%2FgetExchangeResponse~supply_tag_id%3D%7Eviewability%3D0.89%7Eamp%3D1%7Ecbdp%3D0.017%7Edmm%3Dharmony%7Esuid%3DCAESEEDbbBwOYugU9XTgTDofEwM%7Esgmt%3Dsegment_broad_technology_computing%7Esd%3D1%7Edtc%3Deast_sc%7Exid%3DADX-pub-8676560598296682%7Edalg%3Ddefault%7Ehtml%3D1%7Eadblk%3D1921342282%7Esobp%3D%7Ectr%3D0.001261034%7Ebdpcapd%3D0%7Edmm_erpm%3Dtrue%7Ebflr%3D0.010%7Eogbid%3D0.030%7Eac_type%3D1%7Eitype_id%3D17%7Eseller_tag_id%3D%7Ead_blk_key%3D1921342282%7Edetected_tag_id%3D%7Edcut%3D45%7Edogb%3D0-1~ibc%3D1~~mxe%3Dged~mxbn%3DA1&vgd_sc=QC&vstrid=3003130611454751&vgd_vsidv=10&vsidtv=000V10&infr=1&twna=1&stime=1657311463850&vgd_ecrid=1700080807683300300025000000500&l1hcsd=l1!O6005|4504&vgd_l1rhst=contextual.media.net&vgd_uspa=0&tdAdd[]=%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_isiolc=1&pvl=%7B%22dtc%22%3A%22east_sc%22%2C%22mbr%22%3A1%2C%22l1rpth%22%3A%22%2Fnmedianet.js%22%2C%22pgids%22%3A1%7D&vgd_fcm_enc_mis=1&l2ch=0&vgd_pgid=p1947862235t202207082017&vgd_pgids=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS