finclan.com Open in urlscan Pro
2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Public Scan

Software

Resource Hash

a31e0a9cc7760727aea5d6ef28562ffb9ea84e787e884d2c6cc975ba6bf884da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://finclan.com
content-type: application/json
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 21319

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
255 B 394ms
231ms Fetch
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 8cbacfe4f596f4ebf3f3a8aa2191b70035bd3cb47f8514002fb520245387cc85

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://finclan.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
189 B 338ms
131ms Fetch 198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.contextweb.com/header/ortb?src=prebid

Requested by

Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://finclan.com
access-control-expose-headers: Access-Control-Allow-Origin
strict-transport-security: max-age=15768000
access-control-allow-credentials: true
x-no-bid-reason: Passback by decision

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
577 B 306ms
101ms Fetch
application/json 68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-18-213-35-88.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:08 GMT
an-x-request-uuid: 62937561-4a58-44ec-bc61-288d27731cfe
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://finclan.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 882ms
288ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-box-2-0&w=300&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=101aeda2b9d8709f&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.18&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:08 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 886ms
291ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-box-2-0_1&w=300&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=1026e6049898c443&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.18&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:08 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 885ms
288ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-box-2-0_2&w=300&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=10351b239221076e&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.18&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:08 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 889ms
290ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-medrectangle-3-0&w=1&h=1&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=1046a4324ab2297f&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.23&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:08 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 1155ms
284ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-box-3-0&w=468&h=60&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=10566224ebba69da&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.28&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:09 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 1160ms
287ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-edge-1-0&w=160&h=600&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=1065ae66ead0e052&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.2&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:09 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 869ms
288ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-medrectangle-2-0&w=728&h=90&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=10784cda77013322&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.18&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:08 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 204
No Content / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
361 B 873ms
289ms Fetch
text/plain 212.36.83.246
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-finclan_com-edge-2-0&w=160&h=600&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=1082125b3fe1c2a2&schain=1.0%2C1!ezoic.ai%2Cbf5734eeaa204443fefba361eceda733%2C1%2C%2C%2Cfinclan.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%225d758a88-2f22-412a-9363-2270eeb07300%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.18&d=finclan.com&sp=https%253A%252F%252Ffinclan.com%252F&usp=1---&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.36.83.246 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb2.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 16 Oct 2023 14:48:08 GMT
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://finclan.com
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
189 B 289ms
95ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
187 B 263ms
70ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
188 B 262ms
70ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
187 B 288ms
94ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
189 B 263ms
71ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
188 B 287ms
95ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
360 B 263ms
69ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
188 B 263ms
70ms Fetch 34.236.83.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-83-94.compute-1.amazonaws.com
Software: ATS/9.1.10.90 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
x-openrtb-version: 2.5
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.90
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 200 imp.gif
finclan.com/detroitchicago/ 43 B
276 B 65ms
64ms Ping
image/gif 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/detroitchicago/imp.gif
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: br
access-control-max-age: 1728000
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://finclan.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
access-control-allow-headers: Content-Type
content-length: 47
expires: Sun, 15 Oct 2023 14:48:08 GMT

GET
H2 200 iguana.js Show response
finclan.com/beardeddragon/ 51 KB
16 KB 65ms
64ms Script
application/javascript 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/beardeddragon/iguana.js?cb=170
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: 826766f3f3b38f124c944b2f1462582898f3214ca2bb7ce91ea614a614538634

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: br
server: Apache/2.4.39 (Ubuntu)
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 aa05931b-5308-4ea3-95a2-adf84f4ffde4 Show response
config.aps.amazon-adsystem.com/configs/ 537 B
812 B 338ms
123ms Script
application/javascript 18.160.10.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/aa05931b-5308-4ea3-95a2-adf84f4ffde4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-101.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: a1586189fd787c96ab5c2a71eccafaf137c97a23f03787f49d85f62f71e119e7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:42:59 GMT
via: 1.1 06c1d28e93bdae8f6401a12c10b2f570.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: IAD12-P3
age: 309
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 537
x-amz-cf-id: wZEhls5Uuk2MF0ghoFAMlaHQxJKJ235W5ubDcc57Zi7K_mV-KbXfjQ==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 61ms
60ms XHR
application/json 18.67.67.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Ffinclan.com&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.67.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-67-228.iad89.r.cloudfront.net
Software: Server /
Resource Hash: f65cd6deb2a1fb20a4f166cd57981539dbf2228348d52fea5983747aae37329b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:09:12 GMT
via: 1.1 a7a1b4c19abc42d237405ce4c4069f10.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD89-P1
age: 13135
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 4103
x-amz-cf-id: NBIWPg432Ld5bA64F4zCY_zIojqVF1frcel4i8JJ7qonl9Vu992LwA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 251ms
70ms XHR
application/javascript 18.67.67.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.67.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-67-228.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 17:12:52 GMT
x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 199b065e4c1253c9590e1b5e57083906.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD89-P1
age: 77717
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: NBZtBXHZ9VCylb5gurpVqhOK7q8ti8wg3-RNeRVz8W_GJ3OWNWTQqA==

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 243ms
74ms XHR
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20231016

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dc9bf839e0880f32022ea0180f75c59c2c48e814329babaa6942ea93a349da76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 16 Oct 2023 14:48:08 GMT
x-content-type-options: nosniff
content-encoding: br
age: 38837
x-jsd-version: 1.0.1844
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 847
x-served-by: cache-fra-eddf8230103-FRA, cache-yyz4574-YYZ
x-jsd-version-type: version
etag: W/"63b-uw2BLHwSNKQcjgXPBNPgw79qi3k"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 play Show response
videosvc.ezoic.com/ 752 B
691 B 332ms
88ms XHR
application/json 18.213.35.88
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://videosvc.ezoic.com/play?videoID=bb0de1bd1d4239628d7c21769ae3a4a8851d8d884fce662bae2f994a199aadc6&manifest=dash

Requested by

Host: finclan.com
URL: https://finclan.com/beardeddragon/iguana.js?cb=170

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

18.213.35.88 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

openresty/1.15.8.2 /

Resource Hash

3562f68594cc1ff26a81fe48e2c38bcc6d4c5b22da52e158cc9c73adc7c45778

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
server: openresty/1.15.8.2
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://finclan.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type

GET
BLOB 206
Partial Content c184b660-b85c-4b4e-825d-16e57d931479
https://finclan.com/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://finclan.com/c184b660-b85c-4b4e-825d-16e57d931479
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
BLOB 206
Partial Content 4a30bc9a-ed60-4550-9842-a0196b04cecf
https://finclan.com/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://finclan.com/4a30bc9a-ed60-4550-9842-a0196b04cecf
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
BLOB 206
Partial Content 4a30bc9a-ed60-4550-9842-a0196b04cecf
https://finclan.com/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://finclan.com/4a30bc9a-ed60-4550-9842-a0196b04cecf
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
H2

200

tag Show response
btloader.com/
Redirect Chain

https://btloader.com/tag?aax_id=AAX65WOCF&upapi=true
https://btloader.com/tag?o=5112081056530432&upapi=true

373 KB
107 KB

57ms
56ms

Script
application/javascript

2606:4700:20::681a:68b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5112081056530432&upapi=true
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:20::681a:68b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f25cce69a30179b4a50f3f8fe2e6d7e28f9b9671dc5bd5818775f9457b177eb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 16 Oct 2023 14:27:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1083
etag: W/"f92f948b9a24f0213c09fb20433f95df"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ClPW8AfKRI06THjCIpYE6q5qucMd0%2F7%2F7F5qzxwIeeeAE%2FM%2BOL2jHJXQMvP81ekoHZYZ7QTx4mLRlqBJISeIn3uE6e6VYjaTJCOSvEg7%2Fxanxo3go7aEUeOXi%2F3IAsgj0gTKyTYvwP%2BpFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
cf-ray: 817119ddaf5836aa-YYZ

Redirect headers

date: Mon, 16 Oct 2023 14:48:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UzaUQbo1uXuj0yUQhrGdr9HdWgR%2FJxeD%2F5Nm6nSJmebVct8zXOn4x1C4lsNyUaa8vufr3zIOJApNEqA4y%2FgU9SVblws0lf%2Bg2Ygt%2Fl0o%2FuiePXCNL9rfYu8cixwvsbQqSUkDuB%2Fip2Qbog%3D%3D"}],"group":"cf-nel","max_age":604800}
location: https://btloader.com/tag?o=5112081056530432&upapi=true
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 817119dd3eb936aa-YYZ
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 launchpad-liveramp.js Show response
launchpad-wrapper.privacymanager.io/0250bce2-bc41-4233-bbcf-3975c194c8ea/ 3 KB
2 KB 282ms
78ms Script
text/javascript 18.160.46.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad-wrapper.privacymanager.io/0250bce2-bc41-4233-bbcf-3975c194c8ea/launchpad-liveramp.js
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.46.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-46-11.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d2e0e7f7acfe17dd51992096c2d6d6c0389da427f669f35ca32d72791a9a107c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: .rl49h5cCcbcvBA6e2zvSopzSX4cuQ6k
content-encoding: gzip
via: 1.1 f9727388a9890610c008f83558e75e0e.cloudfront.net (CloudFront)
date: Mon, 16 Oct 2023 09:57:13 GMT
x-amz-cf-pop: IAD55-P2
age: 17456
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-disposition: attachment; filename="launchpad-liveramp.js"
last-modified: Wed, 04 Oct 2023 17:08:19 GMT
server: AmazonS3
etag: W/"a09eb9c0f30540cbc5f51bd21a277f35"
vary: Accept-Encoding
content-type: text/javascript
x-amz-cf-id: r0QdmNxQRYbJhntamTicRggI8YNvjFsyzT6HhrDgtT7tyQH8iB4WLQ==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 381ms
97ms Script
application/javascript 23.13.65.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.65.87 Miami, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-65-87.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Mon, 16 Oct 2023 15:03:08 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 39 KB
12 KB 59ms
59ms Script
text/javascript 18.160.46.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.46.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-46-100.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 19:10:10 GMT
content-encoding: gzip
via: 1.1 860065ea331017b0ace9fee85adf8e5c.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:42 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 70679
etag: W/"6e8b1f94eaf615b7d0953ad4e8d8bb85"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 3scKKlD4GP9kp9hLNlWdrJC3DmXDPQaP5d5sh4NTibrMZad9pXR9uw==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 226ms
54ms Script
application/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Ffinclan.com%2F&ref=&_it=amazon&partner_id=524
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ee69abe38a87fd8aa0867401e1e14d2831eab6dfb1bb2d97abf65ac57cb5705

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 07 Sep 2023 17:31:32 GMT
server: cloudflare
x-amz-request-id: 907Z07N0H4YQRTZE
age: 2425
etag: W/"8bbf05f440008747d4df642e30fc4ddc"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 817119dda8385407-YYZ
x-amz-id-2: FTX4uTVOoCJnlfZvtg3cS2GHfBFAI/wkwGXMvvfwDzP+hX8bS7Tqr3U+IhvV3h140Zc4iKtAHTg=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 138 KB
30 KB 61ms
61ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89a9b728cbc4ea20ef9c0934035ba3300049c50682dcc0e58452c40749b6d853

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 16 Oct 2023 11:34:12 GMT
server: cloudflare
x-amz-request-id: BD7RT6WWSDQ3YJD8
age: 3210
etag: W/"cc062d3a08ec5f94b7d1ab377b1e95bd"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 817119dbdb39a1e6-YYZ
x-amz-id-2: Kww/meGHNsveMasSeSW6QSWjd116KZM15Ey7eq4a0fuxfss7WcY9huFyQ9VMH30tsidUBTniEefXHcR58rXugg==

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 366ms
96ms Script
application/javascript 23.13.65.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.65.87 Miami, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-65-87.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "38c0-5e92054540ea5-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 5252
expires: Mon, 16 Oct 2023 15:03:08 GMT

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Ffinclan.com%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Ffinclan.com%2F&rid=esp&cc=1

85 B
203 B

64ms
64ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Ffinclan.com%2F&rid=esp&cc=1
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 4100e551a2a9862fd55a134ca566638e78eaf1ebd0d97479f5b4734a03bfdbe5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-4Zh8pjeMCKP8Qjr6VgCZqW33yVI"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://finclan.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Mon, 16 Oct 2023 14:48:08 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://finclan.com
location: /esp?url=https%3A%2F%2Ffinclan.com%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
531 B 311ms
92ms XHR
application/json 34.233.138.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.138.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-138-61.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 355742e2baf6c3b080f45b65b3368eaa9473928316d98a28b2b21de0f165ae80

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:08 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://finclan.com
cache-control: no-cache
x-server: 10.40.37.141
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
227 B 574ms
185ms XHR
text/plain 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame F4C6 15 KB
6 KB 317ms
109ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=finclan.com&us_privacy=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4ba95a958d22f447f9586b7c8b8e7a8e35b3343d415961dc96e4a25cec0acfc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:08 GMT
server: Kestrel
server-processing-duration-in-ticks: 231092
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
529 B 317ms
162ms XHR
application/json 34.233.138.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.138.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-138-61.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 00d898774b1ba066f43101ffd771bfbd17b37e9265255519b1294d2d1116dbcc

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:08 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://finclan.com
cache-control: no-cache
x-server: 10.40.41.72
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 200 script.js Show response
cadmus.script.ac/dahhc4ozyvjm6/ 3 B
434 B 213ms
67ms Script
application/javascript 2606:4700::6812:1791
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cadmus.script.ac/dahhc4ozyvjm6/script.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1791 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 101ead936a2281d53dcc064b7e2a2ab0d53b92ef3ef7b34b668673007895c860

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
last-modified: Mon, 01 Jan 2018 00:00:00 GMT
server: cloudflare
age: 0
etag: W/"601055f6a0c6408859f97b5f0a84bdb88441a80e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=259200,stale-while-revalidate=86400,stale-if-error=259200
cf-ray: 817119ddff5f39f0-YYZ
content-length: 3

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ 75 KB
24 KB 228ms
56ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f56a3556c45543861a8dd9b9bc9b65b1f9d64fbb7dfc03fdb416faf36356db3d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:08 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 1207456
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 02 Oct 2023 15:19:33 GMT
Server: cloudflare
ETag: W/"0680a0a53dae661d4707e1cc0f6bc95a"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dGzzqUHu0VwLEevUtqYLOhzonytnkQScMU5asNNs09QmC7%2BUfealyCio%2BSxjrgB6O%2BOVQpRNT%2B%2Bk4Lt8qaxNblinOYaD1cPJ8H8roAEQO3NheBntcPZcPny7ZL92IIPP2loGRftfNR55UqxJ"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 817119de280a39d5-YYZ

GET
H2 200 xRmzHYFcwycrFoDe_j1679451822486-0wl0fe_t1679451937_base.vtt Show response
video-meta.humix.com/thumbnails/xRmzHYFcwycrFoDe/ 659 B
1 KB 256ms
77ms XHR
binary/octet-stream 2606:4700:3030::6815:2b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-meta.humix.com/thumbnails/xRmzHYFcwycrFoDe/xRmzHYFcwycrFoDe_j1679451822486-0wl0fe_t1679451937_base.vtt
Requested by: Host: finclan.com
URL: https://finclan.com/beardeddragon/iguana.js?cb=170
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:2b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c77058fe3c0349f9e6bd24431d22e9f78aa6cf1a9ee84bfb936387d64bc475d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
via: 1.1 7f810c58196babfb78deeaeab9c8a91a.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: YTO50-C3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 659
last-modified: Fri, 19 May 2023 03:55:48 GMT
server: cloudflare
etag: "b619ed457c28cfd7cb4c6f8b6932cfb2"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C3B983NJTweYGwhumJca8t%2B7XRc9tsCxH3eoActN%2Bj0%2B0GMjGXtYRDqYVPe%2FQgJ1%2FJSLvj6hfTrxBGTKSZYIs5tyLwlOPC7Gwx8O5Ts3jzWZx171ljPcq0PXJqBJHLvs0CBljLSNalag3eEzWJJfaZ5xGw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 817119df095536a2-YYZ
x-amz-cf-id: B-RrDaw8yUS06yh1CS_AXV8Ix1Zx6pgDCunlUXEL_3Uk4Wx6tOc7lw==

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3d2f1224eafb6a9035c3b847f46493f285e48fd81b5e6e34f157a24d36e6230e

Request headers

Referer
Origin: https://finclan.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 bridge3.595.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 5A42 726 KB
233 KB 61ms
60ms Document
text/html 2607:f8b0:4004:c17::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.595.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9de6cf1275e2335cae4231d25e6119cd5bb53cfadd831de5cdfc411de862c6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 263206
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 238136
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Fri, 13 Oct 2023 13:41:22 GMT
expires: Sat, 12 Oct 2024 13:41:22 GMT
last-modified: Tue, 10 Oct 2023 20:31:50 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 281ms
81ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 14:48:08 GMT

GET
H2 200 1e8fb109db6466bb1bdf84f811490336_en-US.vtt Show response
video-meta.humix.com/caption/xRmzHYFcwycrFoDe/ 1001 B
1 KB 375ms
213ms XHR
text/vtt 2606:4700:3030::6815:2b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-meta.humix.com/caption/xRmzHYFcwycrFoDe/1e8fb109db6466bb1bdf84f811490336_en-US.vtt
Requested by: Host: finclan.com
URL: https://finclan.com/beardeddragon/iguana.js?cb=170
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:2b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df8a880c6d40bde7d83656fa07b6848e619acfd1d9700003905a831f0f3e2f06

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: utf-8
via: 1.1 f0d805e341a04f5774e9d3de6f38e1e8.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: YUL62-P1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 1001
last-modified: Fri, 19 May 2023 03:55:48 GMT
server: cloudflare
etag: "1e8fb109db6466bb1bdf84f811490336"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET
content-type: text/vtt; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1G9vxxsctuBgQZwjyIExVdc1V6C8nkFfPe40jhWlsjPcIkT5vfttlBX1ObSbPLz%2FCr7gmE0tJ%2F2tvO63NtcaYdiJeQHAY5UPvlwZifjsmo3UADQQ0jBqjNvs4J6mNKxPQ%2F2wXvk6dSqhlK1CpalDTB%2FzKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-language: en-US
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 817119df399d36a2-YYZ
x-amz-cf-id: FqtXC507JzU8gTOw0WkGn2KVmqD_2RE1SdO-lkSujEnVbXt3dw-PrA==

GET
H2 200 bb0de1bd1d4239628d7c21769ae3a4a8851d8d884fce662bae2f994a199aadc6_uQHuKf.jpg
finclan.com/ezoimgfmt/streaming.humix.com/poster/xRmzHYFcwycrFoDe/ 42 KB
42 KB 365ms
364ms Image
image/webp 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://finclan.com/ezoimgfmt/streaming.humix.com/poster/xRmzHYFcwycrFoDe/bb0de1bd1d4239628d7c21769ae3a4a8851d8d884fce662bae2f994a199aadc6_uQHuKf.jpg?ezimgfmt=ng%3Awebp%2Fngcb1%2Frs%3Adevice%2Frscb1-1
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94a41368512a220e8fa02317befc7cc26fe5221f40abe126e28ac4dcadd7af46

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 UTC
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 209644
display: staticcontent_sol
x-ezoic-cdn: Miss
x-middleton-display: staticcontent_sol
cf-cached-behind: true
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400
response: 200
last-modified: Sat, 14 Oct 2023 04:34:04 GMT
server: cloudflare
x-origin-cache-control: max-age=2678400
vary: Accept-Encoding,X-Ezoic-Excludewebp,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PYVlmOqakJ7M9m8%2F3IIaOgVyspJEpbUTqDOFzKddgmndyaUtf8zpmaebOyqgONCImJwhrPm4v4%2FODJhrcM9tH1dLnESr%2F3fTpPs0VoeLUNyCtjyVss6PdPwaHBKpzXbwD9VK%2Fr%2FiJX0kw2rqzPwvb076"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 817119de498e3ad8-IAD

GET
H2 200 vid.gif
finclan.com/detroitchicago/ 43 B
120 B 125ms
124ms Image
image/gif 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://finclan.com/detroitchicago/vid.gif?e=%5B%7B%22domain_id%22%3A152251%2C%22owner_domain_id%22%3A423261%2C%22humix_channel_id%22%3A27652%2C%22url%22%3A%22https%3A%2F%2Ffinclan.com%2F%22%2C%22pageview_id%22%3A%2278598779-2a9f-4e5f-44e0-7333b4318a7a%22%2C%22visit_uuid%22%3A%22596c67a6-a2e5-4637-47c7-167ad89b41a0%22%2C%22template_id%22%3A134%2C%22video_impression_id%22%3A%227bc08fe8-ebde-47ad-b0b2-2d5f72358152%22%2C%22media_src%22%3A%22https%3A%2F%2Fstreaming.humix.com%2Fcontents%2FxRmzHYFcwycrFoDe%2F1679451938%2Findex.mpd%22%2C%22player_type%22%3A%22default%22%2C%22video_title%22%3A%22Who%20is%20the%20number%201%20bank%20in%20America%3F%22%2C%22video_position_id%22%3A3998%2C%22is_autoplay%22%3A1%2C%22is_floating%22%3A1%2C%22floating_option%22%3A1%2C%22is_playlist_item%22%3A0%2C%22vab_test_id%22%3A%22mod233-c%22%2C%22is_preferred%22%3Afalse%2C%22video_length%22%3A55355%2C%22content_id%22%3A%22bb0de1bd1d4239628d7c21769ae3a4a8851d8d884fce662bae2f994a199aadc6%22%2C%22width%22%3A640%2C%22height%22%3A360%2C%22pos_x%22%3A480%2C%22pos_y%22%3A1184%2C%22video_objects_count%22%3A1%2C%22video_objects_index%22%3A1%2C%22video_selection_type%22%3A10%2C%22video_match_score%22%3A74%2C%22is_blocker_on%22%3A0%2C%22video_source%22%3A%22import-from-youtube%22%2C%22score_group_id%22%3A1%2C%22collection_id%22%3A90%2C%22video_ranking_config_id%22%3A1%2C%22video_auto_insert_impression_id%22%3A%22d06b4556-7d69-43e8-7613-0160e8ee291e%22%2C%22is_humix_app%22%3A0%7D%5D
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
content-encoding: br
vary: Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 47
expires: Sun, 15 Oct 2023 14:48:09 GMT

GET
H2 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 88CA 40 KB
14 KB 298ms
85ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6300f448d738e70ac11f0140df0b3ce91a2de9e0da7fdf09d32d28031600ba51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:43:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 281
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13893
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 15:57:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 16 Oct 2023 15:43:27 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 96 B
286 B 77ms
77ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=524&sync=0&domain=finclan.com&url=https://finclan.com/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Ffinclan.com%2F&ref=&_it=amazon&partner_id=524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7007b658cfd1c163d4d1e00fb9cb02a84df248369576d457112806007415f261

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 817119dfcc5ea1ea-YYZ

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 236ms
69ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=524&sync=0&domain=finclan.com&url=https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://finclan.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 817119df4bb9a1ea-YYZ
content-length: 0
content-type: application/json
date: Mon, 16 Oct 2023 14:48:08 GMT
debug: OPTIONS block
expires: Tue, 15 Oct 2024 14:48:08 GMT
server: cloudflare

GET
H2 200 launchpad.bundle.js Show response
launchpad.privacymanager.io/latest/ 51 KB
15 KB 275ms
75ms Script
application/x-javascript 18.160.18.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Requested by: Host: launchpad-wrapper.privacymanager.io
URL: https://launchpad-wrapper.privacymanager.io/0250bce2-bc41-4233-bbcf-3975c194c8ea/launchpad-liveramp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.18.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-18-73.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bfcbca5f0ec7aff19873aaa7549b1d707e99341dc955d0a470d2204eb695151d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 2wv74L4PUkUw8ytMV.GVtZ7ESxCnCvrg
content-encoding: br
via: 1.1 dbd1543e724393accac6fa465477c430.cloudfront.net (CloudFront)
date: Mon, 16 Oct 2023 14:12:56 GMT
x-amz-cf-pop: IAD12-P4
age: 2113
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:469675294282:build/LaunchPadLibraryBuild-prod:df93851b-45a1-4c6e-8d06-5a0a28afcfdb
x-cache: Hit from cloudfront
x-amz-meta-codebuild-content-md5: bab004dc3646564a04caf2dfb15bd632
last-modified: Thu, 05 Oct 2023 12:06:35 GMT
server: AmazonS3
etag: W/"cf95a382ff5867af0a1fba09fa5687a8"
vary: Accept-Encoding
content-type: application/x-javascript
x-amz-meta-codebuild-content-sha256: 606068609e52652b939bf8bf8216916f19575fb6d57ee8746f72cddfe11a4001
cache-control: must-revalidate,public,max-age=3600
x-amz-cf-id: MIGfRkCDc7DTATnIxlkbapGFDLPEoIGWLEQQgWLPOm0X3fUabEPxfQ==

GET
H2 200 index.mpd Show response
streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/ 2 KB
1 KB 427ms
239ms XHR
application/xml 2606:4700:3030::6815:2b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/index.mpd
Requested by: Host: finclan.com
URL: https://finclan.com/beardeddragon/wyvern.js?cb=75
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:2b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81b6942ae6081731f360ffe1db697906674715fdd80535447c77e6289c32c6af

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"8b83409b8857983a88545301c35ce0ce"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=81wqk9hIOGrgC8l%2FqHMt4IPpswN7vD4kADYSRuglDFsc%2BHMjYy6p0ozu%2BkNXtdq97oGTRadM9%2FDbxUb%2BpzrJKzjI22EswS6oFWporh%2BDfx%2F4MYDxMkh09nHBUvPMFznOIDb%2BlFaIue8oDybLu8BHNiTN"}],"group":"cf-nel","max_age":604800}
content-type: application/xml
access-control-allow-origin: *
cf-ray: 817119dfce17a216-YYZ
alt-svc: h3=":443"; ma=86400

GET
BLOB 200
OK a7fb5a46-d1af-4bc5-b77b-9fdf1d1ed9b5
https://finclan.com/ 5 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://finclan.com/a7fb5a46-d1af-4bc5-b77b-9fdf1d1ed9b5
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 726c56df390217b441f0dff30b279df005a0d1ed1b60da38021fcf8ee2a15fa6

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 4974
Content-Type: application/javascript

GET
BLOB 200
OK 321175a1-1859-4049-b536-0f63e8e56abd
https://finclan.com/ 80 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://finclan.com/321175a1-1859-4049-b536-0f63e8e56abd
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 211ccd833736c5e7bdfdcc1e73cdad3f8e9b3f4259b131e00f6b7db24d61c351

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 81715
Content-Type: application/javascript

GET
BLOB 200
OK 96de42a8-1aca-40c0-aea0-a1a5d8ecc910
https://finclan.com/ 80 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://finclan.com/96de42a8-1aca-40c0-aea0-a1a5d8ecc910
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 211ccd833736c5e7bdfdcc1e73cdad3f8e9b3f4259b131e00f6b7db24d61c351

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 81715
Content-Type: application/javascript

GET
H2 204 state Show response
api.btloader.com/mw/ 0
101 B 218ms
66ms Fetch 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/mw/state?bt_env=prod
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Oct 2023 14:48:08 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
337 B 227ms
67ms Image
image/gif 2606:4700:20::681a:246
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1993356
x-guploader-uploadid: ADPycduZLT4Egz3OccUY8BO9HQhQaPFB1QvWSXP2JV1sLWPG2UMlJ21pZzB414VM8V9U1p0QRqWsN_H-40vvify-oj-t3Akd6WML
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qv5vCse5rsF2ZiM9GMmhPxkzz6Pfn9sRMeKGs9pax%2BU5hfjIxwdNAy0AdrO51YYa8Yoe3q3LJ328GYxcDNT6PDYLSBk6b2eaQ5MQjXknt%2FUhjn0lcLjQFJ5u5%2FyMSbFR2kPMbfudASqWVYsP0A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 817119e0183839f9-YYZ
expires: Sat, 23 Sep 2023 13:27:11 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
570 B 294ms
92ms Image
image/x-icon 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 13:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4653
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Oct 2023 13:30:36 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
939 B 226ms
66ms Image
image/gif 2606:4700:20::681a:246
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.33790182090684096
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1993356
x-guploader-uploadid: ADPycduZLT4Egz3OccUY8BO9HQhQaPFB1QvWSXP2JV1sLWPG2UMlJ21pZzB414VM8V9U1p0QRqWsN_H-40vvify-oj-t3Akd6WML
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=laUmLfjyBBgtwSWE5gD9Lrsn0sw%2Bz0Y%2BhkhC6Wj1li%2Bu60xLi2Z28%2BwbQdlOACGz%2BjHubaOsGlmErGsG7VjesGKzQqhTU5yY%2ByHwccTPJNq%2Fz80CtXBN5KrrQgWSlbN0kdKx8tLGw9qBu7oHSA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 817119e0183239f9-YYZ
expires: Sat, 23 Sep 2023 13:27:11 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
638 B 907ms
907ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=4451969249455887&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&didk=3890690225&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1697467688847&lmt=1697492888&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=false&a3p=EhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIbCgwzM2Fjcm9zcy5jb20Y_8jVx7MxSABSAghkEhkKCnB1YmNpZC5vcmcY_MvVx7MxSABSAghqEhgKCXlhaG9vLmNvbRjly9XHszFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_8jVx7MxSABSAghkEhcKCHJ0YmhvdXNlGOnL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIUCgVvcGVueBj_yNXHszFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGP7I1cezMUgAUgIIZA..&dlt=1697467687435&idt=605&prev_scp=iid1%3D4104119500757248%26tap%3Dfinclan_com-pixel1-4104119500757248%26bra%3Dmod233-c%26reft%3Dn%26eb_br%3D5f2b94bb26a5aa9b1a00e66d30cfd5ec%26ga%3D2497208%26ic%3D1%26ezoic%3D1%26avc%3D340%26br1%3D500%26br2%3D350%26bvr%3D0%26al%3D1006%26ap%3D9999%26d%3D152251&cust_params=amznbid%3D0%26amznp%3D0&adks=1856613869&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79f4f8cf70803f5b787e340fe81e0dd89ace9918c22981ab1ecddc657bd30c16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 607
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C0EC 6 KB
3 KB 283ms
85ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:09 GMT
expires: Tue, 15 Oct 2024 14:48:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/ 38 KB
13 KB 58ms
57ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl_page_level_ads.js?cb=31078769

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc2b61cf28583354672e9ceb5b4c4d8e182e8e9e2003df6fa8723a1dc459fbd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 13:31:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4614
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13428
x-xss-protection: 0
server: cafe
etag: 7072425772309545193
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 15 Oct 2024 13:31:14 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame B014 594 B
810 B 206ms
61ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 3df1e4ea9dd59bdfa553119d996d24f972b0fa86b0c671588db75376aedb0e1c

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 384
content-type: text/html
date: Mon, 16 Oct 2023 14:48:09 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2

200

sid Show response
mug.criteo.com/ Frame F4C6
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=finclan.com&sn=ChromeSyncframe&so=0&topUrl=finclan.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=ai8SKXxVVDhOMGowVDdWNmZ2cWxHZmFjMjU0ZFRkZWVIalcvdmVTQ0ppMGtxdGh2cU9EbXlzcGJZOVI1K0dpaElSdWhkTVoyUkFFdWtIam1ML01USWVSY0xydkhEYUVlNlM2MFF5QThrdk1jSUFjNEQvb2o2dEFBOEdQWW...

441 B
658 B

339ms
127ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=ai8SKXxVVDhOMGowVDdWNmZ2cWxHZmFjMjU0ZFRkZWVIalcvdmVTQ0ppMGtxdGh2cU9EbXlzcGJZOVI1K0dpaElSdWhkTVoyUkFFdWtIam1ML01USWVSY0xydkhEYUVlNlM2MFF5QThrdk1jSUFjNEQvb2o2dEFBOEdQWWhKL0pyMzhYOVFWY2RpNTk1UHZzd2QySHVCRVU4MlZFK0l1L1NpMXZUbnpud1A3VWt2MGNJSkRlZDF6S25rNGk0eFFvRnRaTmw5TXR6TUFkc0xTcCtEMVJKWWlWS0FheWREMmxtSm0wbGhRcXZQaitNTDUvbzA3TnBZeVQ5RjB3WDVVWHdsbk5sQ1c2c2I4UVFaZFBvaXFTYktXRk9LQT09fA&cppv=2

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3a51941b9fb26fba447c015eb26d38597dc4ad8dced42b77985c8879a744664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:08 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2361444
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:08 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=ai8SKXxVVDhOMGowVDdWNmZ2cWxHZmFjMjU0ZFRkZWVIalcvdmVTQ0ppMGtxdGh2cU9EbXlzcGJZOVI1K0dpaElSdWhkTVoyUkFFdWtIam1ML01USWVSY0xydkhEYUVlNlM2MFF5QThrdk1jSUFjNEQvb2o2dEFBOEdQWWhKL0pyMzhYOVFWY2RpNTk1UHZzd2QySHVCRVU4MlZFK0l1L1NpMXZUbnpud1A3VWt2MGNJSkRlZDF6S25rNGk0eFFvRnRaTmw5TXR6TUFkc0xTcCtEMVJKWWlWS0FheWREMmxtSm0wbGhRcXZQaitNTDUvbzA3TnBZeVQ5RjB3WDVVWHdsbk5sQ1c2c2I4UVFaZFBvaXFTYktXRk9LQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 277643
content-length: 0
expires: 0

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 98ms
98ms Script
application/javascript 23.13.65.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.65.87 Miami, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-65-87.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:08 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "c4b6-5e920545406d3-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17042
expires: Mon, 16 Oct 2023 15:03:08 GMT

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
606 B 55ms
55ms Fetch
application/json 13.32.151.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-103.iad66.r.cloudfront.net
Software: /
Resource Hash: b7f807205142bbe9c42e24df2a3bcdaf29b0027d7a21b7fa9fe816c39d6dc3db

Request headers

Accept: application/json
Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 16 Oct 2023 08:43:08 GMT
via: 1.1 d7441270a7210a12742f2ba6f1dfb028.cloudfront.net (CloudFront), 1.1 2f58b5586b40002efa57d2542863b53e.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD61-P2, IAD66-C2
age: 21901
x-amzn-requestid: 101d1ccb-f853-4145-b27d-e3a41ead547c
x-amzn-trace-id: Root=1-652cf79c-1cf4ce1033241037454c8ae8;Sampled=0;lineage=06620786:0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: M4ughG8LjoEEc6g=
content-length: 30
x-amz-cf-id: jnL-ZDqgA0Vk3nwtc8suT8hYwO2JmUOMTJc1uHHR0wsw3oYGidZu1A==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

OPTIONS
H2 200 /
geo.privacymanager.io/ Frame 0
0 350ms
147ms Preflight
application/json 13.32.151.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-103.iad66.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://finclan.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Mon, 16 Oct 2023 14:48:09 GMT
via: 1.1 21a5f0e24a694c040922a8766d75a2e0.cloudfront.net (CloudFront), 1.1 2f58b5586b40002efa57d2542863b53e.cloudfront.net (CloudFront)
x-amz-apigw-id: M5j-fFdCDoEEMtQ=
x-amz-cf-id: MTsGqDWu51rvEcINO9OJcsnONQmE779lZUqUpbunHxpJu8doBnuNpg==
x-amz-cf-pop: IAD61-P2 IAD66-C2
x-amzn-requestid: 63eb89b1-8554-41d0-a010-dbf4415f096a
x-cache: Miss from cloudfront

GET
H2 200 524 Show response
a.ad.gt/api/v1/u/matches/ 12 KB
4 KB 237ms
50ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/524?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Ffinclan.com%2F&ref=&_it=amazon&partner_id=524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30a6bae51a679e32136aad47747add2f1a415fdf55b971d6f0954c189984210a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 16 Oct 2023 14:45:05 GMT
server: cloudflare
age: 184
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 817119e15f8836ce-YYZ

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
460 B 314ms
94ms XHR
application/json 2606:ae80:1471:12::500
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:12::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
server: nginx
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
vary: Origin
content-type: application/json
access-control-allow-origin: https://finclan.com
cache-control: max-age=1800
access-control-allow-credentials: true
content-length: 190
expires: Mon, 16 Oct 2023 15:18:09 GMT

GET
H2 200 0c395f92-d8c6-e956-c810-b13c5cb09418
pr-bh.ybp.yahoo.com/sync/openx/ Frame B014 43 B
604 B 333ms
117ms Image
image/gif 2600:1f18:4e9:5a01:3a63:cfe:3dc:4ef6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/0c395f92-d8c6-e956-c810-b13c5cb09418?gdpr=0

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:3a63:cfe:3dc:4ef6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame B014
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=c02845ab-54c0-c0e5-39c9-255ecbd492b1
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=c02845ab-54c0-c0e5-39c9-255ecbd492b1&dcc=t

43 B
855 B

79ms
79ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=c02845ab-54c0-c0e5-39c9-255ecbd492b1&dcc=t

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:09 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: FZ3CA8VRF39X07R1BTGS
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:09 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 88X9PWVTX4NSFAFJ5AY9
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=c02845ab-54c0-c0e5-39c9-255ecbd492b1&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame B014
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=98fe39d6-486a-7b1f-f9c7-a7c9a3e75951&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=98fe39d6-486a-7b1f-f9c7-a7c9a3e75951&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&ttd_puid=98fe39d6-486a-7b1f-f9c7-a7c9a3e75951&gdpr=0&gdpr_consent=

43 B
249 B

63ms
60ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&ttd_puid=98fe39d6-486a-7b1f-f9c7-a7c9a3e75951&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&ttd_puid=98fe39d6-486a-7b1f-f9c7-a7c9a3e75951&gdpr=0&gdpr_consent=
date: Mon, 16 Oct 2023 14:48:09 GMT
server: Kestrel
content-length: 335

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame B014
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjQ5MWVhMWMtODExZC0yNWJiLWVjMjctZmQ3MDY5MDU5NzMx
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjQ5MWVhMWMtODExZC0yNWJiLWVjMjctZmQ3MDY5MDU5NzMx&google_tc=

170 B
243 B

82ms
81ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjQ5MWVhMWMtODExZC0yNWJiLWVjMjctZmQ3MDY5MDU5NzMx&google_tc=

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjQ5MWVhMWMtODExZC0yNWJiLWVjMjctZmQ3MDY5MDU5NzMx&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame B014
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEZKYlQrMYt7ObftLmYBn0M&google_cver=1

43 B
180 B

48ms
44ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEZKYlQrMYt7ObftLmYBn0M&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEZKYlQrMYt7ObftLmYBn0M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 country Show response
api.btloader.com/ 16 B
141 B 92ms
91ms Fetch
application/json 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 8bd69d0dddab8bc553263c254faad469c2a3e08bfb0b737e763f7feabe571225

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 59ms
59ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=gPwQisB0F&w=5275717644845056&o=5112081056530432&cv=2.1.19-1-g9747148&r=false&vr=1600x1200&pageURL=https%3A%2F%2Ffinclan.com%2F&sid=JPMTHyhjUe&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?aax_id=AAX65WOCF&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
DATA 200
OK truncated Show response
/ 1001 B
1001 B XHR
text/vtt

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df8a880c6d40bde7d83656fa07b6848e619acfd1d9700003905a831f0f3e2f06

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: text/vtt

GET
H2 200 524 Show response
p.ad.gt/api/v1/p/ 40 KB
12 KB 231ms
54ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/p/524
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/524?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37e316ddcd374a941c2981554b5ede49e1b79d2d1e0c79756a52525bb38f58e4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 16 Oct 2023 14:44:09 GMT
server: cloudflare
age: 240
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 817119e2cfc636ad-YYZ

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
113 B 293ms
130ms Image
image/gif 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&halo_id=060kihgfc676faj6hbef6ekceadlebk8k98yusqoi020oew0sgmo0myimek0mgy4y
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e2ba7439d8-YYZ
content-length: 43
content-type: image/gif

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&adnxs_id=$UID&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001697467689-EXZ8BLB9-9HH7%26adnxs_id%3D%24UID%26gdpr%3D0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&adnxs_id=4396685237194775250&gdpr=0

43 B
95 B

168ms
168ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&adnxs_id=4396685237194775250&gdpr=0
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e2eb0b39d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
an-x-request-uuid: 0b73b9f2-58a2-4021-8489-545dced84516
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&adnxs_id=4396685237194775250&gdpr=0
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001697467689-EXZ8BLB9-9HH7&gdpr=0
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001697467689-EXZ8BLB9-9HH7&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7

43 B
95 B

129ms
128ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e35bb739d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
date: Mon, 16 Oct 2023 14:48:09 GMT
server: Kestrel
content-length: 259

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001697467689-EXZ8BLB9-9HH7
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001697467689-EXZ8BLB9-9HH7
https://ids.ad.gt/api/v1/pbm_match?pbm=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7

43 B
95 B

146ms
146ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e41d1139d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

location: https://ids.ad.gt/api/v1/pbm_match?pbm=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001697467689-EXZ8BLB9-9HH7&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&rub=LNT0FMYN-1I-1UTL&gdpr=0

43 B
95 B

125ms
125ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&rub=LNT0FMYN-1I-1UTL&gdpr=0
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e3fcd439d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&rub=LNT0FMYN-1I-1UTL&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001697467689...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001697...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=191342ee-83f6-464d-8889-cb63456fece9%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&ttd_puid=191342ee-83f6-464d-8889-cb63456fece9%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&tapad_id=191342ee-83f6-464d-8889-cb63456fece9

43 B
95 B

121ms
121ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&tapad_id=191342ee-83f6-464d-8889-cb63456fece9
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e52ee439d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

date: Mon, 16 Oct 2023 14:48:09 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&tapad_id=191342ee-83f6-464d-8889-cb63456fece9
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

g_match
ids.ad.gt/api/v1/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm=&google_sc=&google_ula=450542624&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&google_tc=
https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&google_gid=CAESELrX5M4nNn6DdkLTmtF6KII&google_cver=1&google_ula=450542624,0

43 B
95 B

144ms
144ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&google_gid=CAESELrX5M4nNn6DdkLTmtF6KII&google_cver=1&google_ula=450542624,0
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e37bee39d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&google_gid=CAESELrX5M4nNn6DdkLTmtF6KII&google_cver=1&google_ula=450542624,0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 357
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY5NzQ2NzY4OS1FWFo4QkxCOS05SEg3

170 B
232 B

77ms
77ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY5NzQ2NzY4OS1FWFo4QkxCOS05SEg3

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY5NzQ2NzY4OS1FWFo4QkxCOS05SEg3
date: Mon, 16 Oct 2023 14:48:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e2ba7139d8-YYZ
content-type: text/html; charset=utf-8

GET
H2

200

adb_match
ids.ad.gt/api/v1/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=348447&dpuuid=AU1D-0100-001697467689-EXZ8BLB9-9HH7&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fadb_match%3Fadb%3D%24%7BDD_UUID%7D%26id%3DAU1D-0100-001697467689-EXZ8BL...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=348447&dpuuid=AU1D-0100-001697467689-EXZ8BLB9-9HH7&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fadb_match%3Fadb%3D%24%7BDD_UUID%7D%26id%3DAU1D-01...
https://ids.ad.gt/api/v1/adb_match?adb=31398565450724977764220907576422214345&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7

43 B
95 B

166ms
166ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/adb_match?adb=31398565450724977764220907576422214345&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e45d6839d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

DCS: dcs-prod-va6-1-v051-04afb793b.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: P/66bNnDQf8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://ids.ad.gt/api/v1/adb_match?adb=31398565450724977764220907576422214345&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

impr_match
ids.ad.gt/api/v1/
Redirect Chain

https://ad.360yield.com/ux?&publisher_dmp_id=15&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fimpr_match%3Fid%3DAU1D-0100-001697467689-EXZ8BLB9-9HH7%26impr_uid%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/ux?&publisher_dmp_id=15&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fimpr_match%3Fid%3DAU1D-0100-001697467689-EXZ8BLB9-9HH7%26impr_uid%3D%7BPUB_USER_ID%7D
https://ids.ad.gt/api/v1/impr_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&impr_uid=a02bb775-51a6-4f25-b6c7-b435303f76a2

43 B
118 B

122ms
121ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/impr_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&impr_uid=a02bb775-51a6-4f25-b6c7-b435303f76a2
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e6088c39d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

location: https://ids.ad.gt/api/v1/impr_match?id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&impr_uid=a02bb775-51a6-4f25-b6c7-b435303f76a2
access-control-allow-origin: *
date: Mon, 16 Oct 2023 14:48:09 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001697467689-EXZ8BLB9-9HH7%26auid%3DAU...
https://ids.ad.gt/api/v1/openx?openx_id=b1be20b3-c1e6-44e3-aa3c-b399b4989655&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&auid=AU1D-0100-001697467689-EXZ8BLB9-9HH7

43 B
95 B

131ms
131ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=b1be20b3-c1e6-44e3-aa3c-b399b4989655&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&auid=AU1D-0100-001697467689-EXZ8BLB9-9HH7
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e3ecb039d8-YYZ
content-length: 43
content-type: image/gif

Redirect headers

date: Mon, 16 Oct 2023 14:48:09 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://ids.ad.gt/api/v1/openx?openx_id=b1be20b3-c1e6-44e3-aa3c-b399b4989655&id=AU1D-0100-001697467689-EXZ8BLB9-9HH7&auid=AU1D-0100-001697467689-EXZ8BLB9-9HH7
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 223 KB
65 KB 80ms
80ms Script
application/javascript 23.13.65.87
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.65.87 Miami, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-65-87.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 59809587724422a1623f2ea0b361f2c72e2febc92e37faa84dc4b859674e826d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
content-encoding: gzip
last-modified: Tue, 22 Aug 2023 17:51:49 GMT
server: Apache
etag: "37c41-60386a6319d17-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 66128
expires: Mon, 16 Oct 2023 15:03:09 GMT

GET
H2 200 t1679451819_01_640x360p_30Hz_800Kbps_init.mp4 Show response
streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/ 844 B
1 KB 226ms
225ms XHR
video/mp4 2606:4700:3030::6815:2b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/t1679451819_01_640x360p_30Hz_800Kbps_init.mp4
Requested by: Host: finclan.com
URL: https://finclan.com/beardeddragon/wyvern.js?cb=75
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:2b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfc2e7b590634dab271cde2546b5549b48bee3621a96579b688539e33cb4c6cd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "3b7946c196e3553818e4c933e47f2287"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=urF4NSN5%2BTBn7%2Bqe6gNCs5c%2BH%2BZiX6bzLQzfTKisyeBqG3zixOoshUTAwm2zZNfwggeuVhXkNUqrXx09%2BIf0eyeNehMtCY967Da0SLR3wOJCsg6z7ICHz%2F%2BN8yWci0vLz1uuHF0QrLXavUm6zpXeE3YG"}],"group":"cf-nel","max_age":604800}
content-type: video/mp4
access-control-allow-origin: *
cf-ray: 817119e27a89a216-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 844

GET
H2 200 t1679451819_01_640x360p_30Hz_800Kbps_001.m4s Show response
streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/ 45 KB
45 KB 227ms
227ms XHR
application/octet-stream 2606:4700:3030::6815:2b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/t1679451819_01_640x360p_30Hz_800Kbps_001.m4s
Requested by: Host: finclan.com
URL: https://finclan.com/beardeddragon/wyvern.js?cb=75
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:2b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c78e3176518aae4fd34611e240751b1450663730bcdd9a124a7d24379b793315

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "34dab150850df575d1d154ab9de2e77f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eOxkmt4apBVv1hM4CRzh8BaVUEdWPpleRgUnBfvtcgYfyIRWkyj45tubY1FSI%2Bn1%2B9zDHXnAO5oa7t%2Bt5Ip5eMBzA9%2BkzNAsq09lShvbWMelxiNme19uKl4AK8slW5lx9XDO36I4sUt1sXRTEEkNzl0y"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 817119e27a8ca216-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 46106

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
271 B 676ms
282ms Fetch
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

6d0638ec7cc038707710d6131036582053d34abe8631ffb580c91527ea059463

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:09 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3 200 audio_init.mp4 Show response
streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/ 826 B
1 KB 297ms
297ms XHR
video/mp4 2606:4700:3030::6815:2b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/audio_init.mp4
Requested by: Host: finclan.com
URL: https://finclan.com/beardeddragon/wyvern.js?cb=75
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::6815:2b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ce4c57115136b4ea7366ff40c4937b34aad2f0e4adb9bf51a8fe70f3b9b55c4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "d2c0a2227cdea978ac5c1a00a043b435"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s%2ByuGtTYEftPZKW%2Fz4IYZpZx%2B519pM7YSVMzulQrV53%2FLKxOQFg2Tq5N7E0ozLjOTxESk7oyj%2FIEjGQsQfSzoVZ1rfwNltiXl3rKbfj%2F7j8TvgJiMJMTSmuDRmczbjtzuXXrZPvsvl7fNAC5a7CN9GFZ"}],"group":"cf-nel","max_age":604800}
content-type: video/mp4
access-control-allow-origin: *
cf-ray: 817119e3abb739e3-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 826

GET
H3 200 audio_001.m4s Show response
streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/ 41 KB
41 KB 416ms
415ms XHR
application/octet-stream 2606:4700:3030::6815:2b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/xRmzHYFcwycrFoDe/1679451938/audio_001.m4s
Requested by: Host: finclan.com
URL: https://finclan.com/beardeddragon/wyvern.js?cb=75
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::6815:2b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d7cdbbad9ddf36ed9942b6f853e3fb3bc7575a25e93e27e39c833f5002a9153

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "2fc3e91bfd1916f750487ac40d091b1a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fe9AsIv1TxpUyuJSwIhmnu1qgulq59Lt8J5IKA3ZMhNbB6r4IcunzYxJ46MILJbcvecwHZ4yxMpTQrk4padxCV8R1npemDO1HBegjeNT6TN%2F3RNUPfTiiRrbHt2PyPpbC%2FMboglWD4%2FIS1pDcF4DZ5XA"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 817119e3abb939e3-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 41556

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 269ms
75ms Script
text/javascript 2607:f8b0:4004:c17::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 16 Oct 2023 14:26:14 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 1315
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 16 Oct 2023 16:26:14 GMT

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
159 B 331ms
145ms XHR
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://finclan.com
access-control-allow-credentials: true
cf-ray: 817119e52ba439fc-YYZ

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
108 B 318ms
135ms Script
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=5fc8aa487dad8f17b0ac004634695f0b&url=https%3A%2F%2Ffinclan.com%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 817119e528e336d9-YYZ
content-type: text/html; charset=utf-8

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 5 KB
411 B 1202ms
1202ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1715423734061069&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2%2Cfinclan_com-medrectangle-3%2Cfinclan_com-box-3%2Cfinclan_com-edge-1%2Cfinclan_com-medrectangle-2%2Cfinclan_com-edge-2&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6&prev_iu_szs=300x250%2C300x250%2C300x250%2C1x1%7C1x1%7C1x1%2C468x60%2C160x600%2C970x90%2C160x600&ifi=2&didk=2618579448~1483115519~1483115518~1059404481~2618578417~3980648260~1059391305~3980644605&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1697467689668&lmt=1697492889&adxs=315%2C638%2C962%2C566%2C566%2C0%2C315%2C1440&adys=231%2C231%2C231%2C949%2C1109%2C300%2C1110%2C300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C0%7C0%7C0%7C0&ucis=2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250%7C323x250%7C323x250%7C1110x91%7C1110x60%7C160x-1%7C970x-1%7C160x-1&msz=323x250%7C323x250%7C323x250%7C468x60%7C468x60%7C160x-1%7C970x-1%7C160x-1&fws=4%2C4%2C4%2C4%2C4%2C512%2C512%2C512&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C0%2C0%2C0&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=false&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&cbidsp=CtcDCAESGQoIcHVibWF0aWMQtAQgAlIIcHVibWF0aWMSFwoHcnViaWNvbhD8CyACUgdydWJpY29uEkAKCG1lZGlhbmV0EMQEGiUKEDEzMTIwZDIxZjYxY2VmNGUQ8J4vGgNVU0QoAToGCKwCEPoBIAFSCG1lZGlhbmV0Eg0KAml4EMQCIAJSAml4EhUKBmNyaXRlbxCcBCACUgZjcml0ZW8SGwoJYWR5b3VsaWtlEKMEIAJSCWFkeW91bGlrZRIPCgNhbXgQtAIgAlIDYW14Eh8KC3NtaWxld2FudGVkEI8DIAJSC3NtaWxld2FudGVkEhUKBm9uZXRhZxCjBCACUgZvbmV0YWcSEwoFb3BlbngQjgMgAlIFb3BlbngSHQoKcHVsc2Vwb2ludBDVAiACUgpwdWxzZXBvaW50EiMKCG9mdG1lZGlhELgCIAJSCGFwcG5leHVzUghvZnRtZWRpYRIXCgd2aWRvb215EI0JIAJSB3ZpZG9vbXkSIwoIeWFob29zc3AQ3QUgAlIIeWFob29BZHNSCHlhaG9vc3NwGAIiJDQ4YmRmMjZkLTZiZWYtNGYwZS1hMDBkLTJjOWY4N2VlODY2YSoECAMgADIHdjguMTYuMEDEE0oA~CtcDCAESGQoIcHVibWF0aWMQtAQgAlIIcHVibWF0aWMSFwoHcnViaWNvbhD8CyACUgdydWJpY29uEkAKCG1lZGlhbmV0EMUEGiUKEDEzMjAyZTU2MGJhOWY2YmQQ8J4vGgNVU0QoAToGCKwCEPoBIAFSCG1lZGlhbmV0Eg0KAml4EMQCIAJSAml4EhUKBmNyaXRlbxCdBCACUgZjcml0ZW8SGwoJYWR5b3VsaWtlEKMEIAJSCWFkeW91bGlrZRIPCgNhbXgQtAIgAlIDYW14Eh8KC3NtaWxld2FudGVkEI8DIAJSC3NtaWxld2FudGVkEhUKBm9uZXRhZxCjBCACUgZvbmV0YWcSEwoFb3BlbngQjgMgAlIFb3BlbngSHQoKcHVsc2Vwb2ludBDVAiACUgpwdWxzZXBvaW50EiMKCG9mdG1lZGlhELgCIAJSCGFwcG5leHVzUghvZnRtZWRpYRIXCgd2aWRvb215EI0JIAJSB3ZpZG9vbXkSIwoIeWFob29zc3AQ3QUgAlIIeWFob29BZHNSCHlhaG9vc3NwGAIiJDdiMzM3NzMzLThjZTktNGNkNS1hOTM4LTAzODNhMTBhZWYyOSoECAMgADIHdjguMTYuMEDEE0oA~Cv4DCAESGQoIcHVibWF0aWMQtAQgAlIIcHVibWF0aWMSFwoHcnViaWNvbhD8CyACUgdydWJpY29uEkAKCG1lZGlhbmV0EMUEGiUKEDEzMzhjZTVmZDVkYTUyNzMQ8J4vGgNVU0QoAToGCKwCEPoBIAFSCG1lZGlhbmV0Eg0KAml4EMQCIAJSAml4EhUKBmNyaXRlbxCdBCACUgZjcml0ZW8SQgoJYWR5b3VsaWtlEKIEGiUKEDEyODY1ODYzMWM2NjUwNDkQkKY3GgNVU0QoAToGCKwCEPoBIAFSCWFkeW91bGlrZRIPCgNhbXgQtAIgAlIDYW14Eh8KC3NtaWxld2FudGVkEI8DIAJSC3NtaWxld2FudGVkEhUKBm9uZXRhZxCjBCACUgZvbmV0YWcSEwoFb3BlbngQjgMgAlIFb3BlbngSHQoKcHVsc2Vwb2ludBDVAiACUgpwdWxzZXBvaW50EiMKCG9mdG1lZGlhELgCIAJSCGFwcG5leHVzUghvZnRtZWRpYRIXCgd2aWRvb215EI0JIAJSB3ZpZG9vbXkSIwoIeWFob29zc3AQ3QUgAlIIeWFob29BZHNSCHlhaG9vc3NwGAIiJDlkOGQwOThmLThkZDMtNDdhMy1hZTQ3LTU0NmYxM2JhNjQ1YSoECAMgADIHdjguMTYuMEDEE0oA~CpsDCAESGQoIcHVibWF0aWMQtAQgAlIIcHVibWF0aWMSFwoHcnViaWNvbhD8CyACUgdydWJpY29uEhkKCG1lZGlhbmV0EMYEIAJSCG1lZGlhbmV0Eg0KAml4EMQCIAJSAml4EhUKBmNyaXRlbxCdBCACUgZjcml0ZW8SGwoJYWR5b3VsaWtlEKMEIAJSCWFkeW91bGlrZRIPCgNhbXgQtAIgAlIDYW14Eh8KC3NtaWxld2FudGVkEI8DIAJSC3NtaWxld2FudGVkEhUKBm9uZXRhZxCjBCACUgZvbmV0YWcSHQoKcHVsc2Vwb2ludBDVAiACUgpwdWxzZXBvaW50EiMKCG9mdG1lZGlhELgCIAJSCGFwcG5leHVzUghvZnRtZWRpYRIXCgd2aWRvb215EI0JIAJSB3ZpZG9vbXkSIwoIeWFob29zc3AQ3QUgAlIIeWFob29BZHNSCHlhaG9vc3NwGAIiJDU1MDg5NTZiLTk2ZjItNGI3ZS05OTY2LTM2MDU1MDkwZDRhMSoECAMgADIHdjguMTYuMEDEE0oA~CpsDCAESGQoIcHVibWF0aWMQtAQgAlIIcHVibWF0aWMSFwoHcnViaWNvbhD8CyACUgdydWJpY29uEhkKCG1lZGlhbmV0EMYEIAJSCG1lZGlhbmV0Eg0KAml4EMQCIAJSAml4EhUKBmNyaXRlbxCdBCACUgZjcml0ZW8SGwoJYWR5b3VsaWtlEKMEIAJSCWFkeW91bGlrZRIPCgNhbXgQtAIgAlIDYW14Eh8KC3NtaWxld2FudGVkEI8DIAJSC3NtaWxld2FudGVkEhUKBm9uZXRhZxCjBCACUgZvbmV0YWcSHQoKcHVsc2Vwb2ludBDWAiACUgpwdWxzZXBvaW50EiMKCG9mdG1lZGlhELgCIAJSCGFwcG5leHVzUghvZnRtZWRpYRIXCgd2aWRvb215EI0JIAJSB3ZpZG9vbXkSIwoIeWFob29zc3AQ3QUgAlIIeWFob29BZHNSCHlhaG9vc3NwGAIiJDk3NDA1ZDM5LTkwYWUtNDMzMS1iZWZjLTg1NmNkY2Q0YzcyYioECAMgADIHdjguMTYuMEDEE0oA~CogDCAESFwoHcnViaWNvbhDEEyADUgdydWJpY29uEhkKCG1lZGlhbmV0EMcEIAJSCG1lZGlhbmV0EhUKBmNyaXRlbxCdBCACUgZjcml0ZW8SGwoJYWR5b3VsaWtlEKMEIAJSCWFkeW91bGlrZRIPCgNhbXgQtAIgAlIDYW14Eh8KC3NtaWxld2FudGVkEI8DIAJSC3NtaWxld2FudGVkEjwKBm9uZXRhZxCiBBolChAxMzA3Zjc4ZTVlYjY2YjMxEJPHIhoDVVNEKAE6BgigARDYBCABUgZvbmV0YWcSEwoFb3BlbngQjgMgAlIFb3BlbngSHQoKcHVsc2Vwb2ludBDWAiACUgpwdWxzZXBvaW50EhcKB3ZpZG9vbXkQjQkgAlIHdmlkb29teRIjCgh5YWhvb3NzcBDdBSACUgh5YWhvb0Fkc1IIeWFob29zc3AYAiIkNGFhNDA4NzMtYjkwMy00N2ZkLWI2NGUtMTdjOWRjOTcyNzE3KgQIAyAAMgd2OC4xNi4wQMQTSgA.~CtcDCAESPwoIcHVibWF0aWMQsgQaJAoQMTI3YTBlMzE5NTk0YTk2MhCg_goaA1VTRCgBOgUI2AUQWiABUghwdWJtYXRpYxIXCgdydWJpY29uEPwLIAJSB3J1Ymljb24SPwoIbWVkaWFuZXQQxgQaJAoQMTM0OGM2ZTcyMDRkZDUxOBC47DcaA1VTRCgBOgUI2AUQWiABUghtZWRpYW5ldBINCgJpeBDEAiACUgJpeBIVCgZjcml0ZW8QnQQgAlIGY3JpdGVvEhsKCWFkeW91bGlrZRDEEyADUglhZHlvdWxpa2USDwoDYW14ELQCIAJSA2FteBIfCgtzbWlsZXdhbnRlZBCPAyACUgtzbWlsZXdhbnRlZBIVCgZvbmV0YWcQowQgAlIGb25ldGFnEhMKBW9wZW54EI4DIAJSBW9wZW54Eh0KCnB1bHNlcG9pbnQQ1gIgAlIKcHVsc2Vwb2ludBIXCgd2aWRvb215EI0JIAJSB3ZpZG9vbXkSIwoIeWFob29zc3AQ3QUgAlIIeWFob29BZHNSCHlhaG9vc3NwGAIiJDA0MjlmMjQxLTQxODEtNDAwNC1iNzBlLTgzYmIyMDk1M2FjNSoECAMgADIHdjguMTYuMEDEE0oA~CogDCAESFwoHcnViaWNvbhDEEyADUgdydWJpY29uEkAKCG1lZGlhbmV0EMYEGiUKEDEzNWU1M2UzNWNiNmI3NWUQiI4yGgNVU0QoAToGCKABENgEIAFSCG1lZGlhbmV0EhUKBmNyaXRlbxCdBCACUgZjcml0ZW8SGwoJYWR5b3VsaWtlEKMEIAJSCWFkeW91bGlrZRIPCgNhbXgQtAIgAlIDYW14Eh8KC3NtaWxld2FudGVkEI8DIAJSC3NtaWxld2FudGVkEhUKBm9uZXRhZxCjBCACUgZvbmV0YWcSEwoFb3BlbngQjgMgAlIFb3BlbngSHQoKcHVsc2Vwb2ludBDWAiACUgpwdWxzZXBvaW50EhcKB3ZpZG9vbXkQjQkgAlIHdmlkb29teRIjCgh5YWhvb3NzcBDdBSACUgh5YWhvb0Fkc1IIeWFob29zc3AYAiIkM2ExM2Y1MzMtNWY3ZS00Y2U2LTkxZGMtZGNhMTMxMGYyY2U3KgQIAyAAMgd2OC4xNi4wQMQTSgA.&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D350%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%7Ca%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D350%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%7Ca%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D350%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%7Ca%3D%257C0%257C%26iid1%3D3453499716755464%26eid%3D3453499716755464%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1021%26sap%3D1320%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dfinclan_com-medrectangle-3-3453499716755464%26eb_br%3D6e85b37de1b1ffc2593baa5d6e4b02fc%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D217%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D450%26br2%3D220%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%7Ca%3D%257C0%257C%26iid1%3D7369173194762219%26eid%3D7369173194762219%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1114%26sap%3D1114%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dfinclan_com-box-3-7369173194762219%26eb_br%3D26dfa00588543c52511429ade391f561%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D234%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D550%26br2%3D280%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%7Ca%3D%257C0%257C%26iid1%3D9062749612755322%26eid%3D9062749612755322%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1975%26sap%3D1975%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dfinclan_com-edge-1-9062749612755322%26eb_br%3D76163170a8636ae5b88417f095893e08%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D184%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D400%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4184%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D135e53e35cb6b75e%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.82%26hb_rt%3Dclient%7Ca%3D%257C0%257C%26iid1%3D8831122984812716%26eid%3D8831122984812716%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dfinclan_com-medrectangle-2-8831122984812716%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D15%26bvm%3D0%26bvr%3D5%26avc%3D153%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D350%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C57%2C66%2C20%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D1348c6e7204dd518%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.91%26hb_rt%3Dclient%7Ca%3D%257C0%257C%26iid1%3D2628239510760259%26eid%3D2628239510760259%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1976%26sap%3D1976%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dfinclan_com-edge-2-2628239510760259%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D190%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D350%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26ax_ssid%3D10082%26hb_bidder%3Donetag%26hb_adid%3D1307f78e5eb66b31%26hb_format%3Dbanner%26hb_ssid%3D11291%26hb_opt%3D0.56%26hb_rt%3Dclient&cust_params=amznbid%3D0%26amznp%3D0&adks=414029443%2C1814209332%2C1814209333%2C735801982%2C3394468990%2C2043483273%2C1011857618%2C1968572909&frm=20&is_cau=%2C%2C%2C%2C%2C%2C%2C

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38c39ced3d3183dd7b4d9190ad5d9f43cd24c601137df9c9b9b5d5b5d8c2c690

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 381
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2,-2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2,-2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 greenoaks.gif
finclan.com/detroitchicago/ 0
23 B 121ms
120ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMTAtMTYifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiI3In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiNDIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiZGF0YSI6W3sibmFtZSI6Imxhbmd1YWdlX3RhZyIsInZhbCI6ImVuLVVTIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiZGF0YSI6W3sibmFtZSI6Imxhbmd1YWdlX3ByaW1hcnlfc3VidGFnIiwidmFsIjoiZW4ifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjIzMTQifV19XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:09 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:09 GMT

GET
H2 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ 1 KB
961 B 72ms
71ms Script
text/javascript 2607:f8b0:4004:c17::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:33:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 630
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 16 Oct 2023 15:33:08 GMT

GET
H2 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 136ms
135ms Script
text/javascript 2607:f8b0:4004:c17::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 13:51:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3420
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1129
x-xss-protection: 0
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 16 Oct 2023 14:51:09 GMT

POST
H2 204 greenoaks.gif
finclan.com/detroitchicago/ 0
62 B 56ms
56ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoiaXNfYWRfYmxvY2tlZCIsInZhbCI6ImZhbHNlIn1dfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:10 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:10 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 336ms
80ms XHR
application/json 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202310110101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

767b09843af8a946f87b0f07fea8e9d204993c461b47f5f95c03d90c71c6a1d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12021
x-xss-protection: 0

POST
H2 200 v2 Show response
id5-sync.com/gm/ 635 B
1 KB 671ms
286ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/gm/v2

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4cf0b73f542677b93d1e514b3493c1487511e57afdd339484f43deed95e0e603

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:09 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 275ms
64ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 16 Oct 2023 14:48:10 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 96 KB
31 KB 72ms
72ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

d779718eed5e6af18de75d3edd354975bc904d0e97484222b86f68191a9edcda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 11 Oct 2023 08:53:04 GMT
server: nginx
etag: W/"65266270-17e57"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 17 Oct 2023 14:48:10 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BAE2 13 KB
5 KB 81ms
80ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1310
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:26:20 GMT
expires: Tue, 15 Oct 2024 14:26:20 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7BC9 829 B
1 KB 332ms
110ms Document
text/html 2607:f8b0:4004:c06::63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::63 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a2342a206e7a87e9e2bf4a07c58d9b54f9ef2498d774cd50ec08909c8df4ad65

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rvSHBwlO_RQOedPa5DtSwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-rvSHBwlO_RQOedPa5DtSwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:10 GMT
expires: Mon, 16 Oct 2023 14:48:10 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 034C 15 KB
6 KB 61ms
60ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=finclan.com&us_privacy=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4ba95a958d22f447f9586b7c8b8e7a8e35b3343d415961dc96e4a25cec0acfc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:10 GMT
server: Kestrel
server-processing-duration-in-ticks: 1302426
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.143.js Show response
static.criteo.net/js/ld/ 96 KB
31 KB 327ms
86ms XHR
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.143.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

d779718eed5e6af18de75d3edd354975bc904d0e97484222b86f68191a9edcda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 11 Oct 2023 08:53:04 GMT
server: nginx
etag: W/"65266270-17e57"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 17 Oct 2023 14:48:10 GMT

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://id5-sync.com/i/457/8.gif?id5id=ID5*KH8h1SNBNbEa-aXwF_9Y_HcnL7cnsyNkDcszv63gAqVn8LXGYKYPsi2KJzUzBFgPZ_F9YW05RexMsJGEDHFn9Q&o=api&gdpr_consent=undefined&gdpr=false
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/457/108/7/2.gif?puid=191342ee-83f6-464d-8889-cb63456fece9&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F434%2F6%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/457/434/6/3.gif?puid=81b205a6-6477-43c2-97d2-bca709cce37d&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F112%2F5%2F4.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F112%2F5%2F4.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/457/112/5/4.gif?puid=F15E4BFE16E038D0&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/457/2/4/5.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/457/2/4/5.gif?puid=4396685237194775250&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&ttl=%%TTL%%
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F441%2F2%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/457/441/2/7.gif?puid=u_03b81905-c25c-42e7-a48f-2c61c84cb3b3&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F1%2F8.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/457/429/1/8.gif?puid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&consent=&id5id=ID5-c604aAgkUFGwtBFctkkdPG4-Vmz6MoVGgiJe5qkTRA

49 B
848 B

358ms
129ms

Image
image/gif

69.166.1.67
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&consent=&id5id=ID5-c604aAgkUFGwtBFctkkdPG4-Vmz6MoVGgiJe5qkTRA

Protocol

Server

69.166.1.67 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-69
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 49
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&consent=&id5id=ID5-c604aAgkUFGwtBFctkkdPG4-Vmz6MoVGgiJe5qkTRA
date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2

200

sid Show response
mug.criteo.com/ Frame 034C
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=finclan.com&sn=ChromeSyncframe&so=3&topUrl=finclan.com&bundle=wD6L4V85aXNXZ0lTQlQ3blp1TWFqWUd2NTgxcVd2OEklMkJtRzV4WWRXSFhGSk9CQWNxJTJGbjMx...
https://mug.criteo.com/sid?cpp=08zyBnw3SzRMYnIwK0VUM2p3T0dlT2d1Smh2LzFyMDBGRVBZN3FyWWhORS9nWnpPUUJLYi9IUklxTTNpQjlwMnE1UFlVazdHN3ZlWk4xVlUxeVNUTDZxaEEzenA0aWRXUFVWYmc5UXQwZ1c4ZXhOOEQrUGVjb3pnNnBjWX...

428 B
655 B

96ms
95ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=08zyBnw3SzRMYnIwK0VUM2p3T0dlT2d1Smh2LzFyMDBGRVBZN3FyWWhORS9nWnpPUUJLYi9IUklxTTNpQjlwMnE1UFlVazdHN3ZlWk4xVlUxeVNUTDZxaEEzenA0aWRXUFVWYmc5UXQwZ1c4ZXhOOEQrUGVjb3pnNnBjWXdCNnh3akxFTG01RkdKMnVEbUNxbWg5QTdMOWhTUm5SY2M1QmVmbS9XeDRmdHlKaDl5ODhSY3VTSlpyS0NabWs4cFM2QllCREhiQXZhQzJZWWtraTlTNXhKWjNGWU1vRWltTEJoWTRNa3B4Q1hsdHE3RUZURkx0QW1pVmlKUmxMUWVVUWk4d2NFMTZxd0d3bjdIWkZzdmlXbnBHL08yZ3FSa0FFVW5rcjNURzVBUGl1VXpCRT18&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f09e89c6bc298101a27f57f0a6764f3e309bbfa3467c36f809be7b79c10a4257

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:09 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 808247
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=08zyBnw3SzRMYnIwK0VUM2p3T0dlT2d1Smh2LzFyMDBGRVBZN3FyWWhORS9nWnpPUUJLYi9IUklxTTNpQjlwMnE1UFlVazdHN3ZlWk4xVlUxeVNUTDZxaEEzenA0aWRXUFVWYmc5UXQwZ1c4ZXhOOEQrUGVjb3pnNnBjWXdCNnh3akxFTG01RkdKMnVEbUNxbWg5QTdMOWhTUm5SY2M1QmVmbS9XeDRmdHlKaDl5ODhSY3VTSlpyS0NabWs4cFM2QllCREhiQXZhQzJZWWtraTlTNXhKWjNGWU1vRWltTEJoWTRNa3B4Q1hsdHE3RUZURkx0QW1pVmlKUmxMUWVVUWk4d2NFMTZxd0d3bjdIWkZzdmlXbnBHL08yZ3FSa0FFVW5rcjNURzVBUGl1VXpCRT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2211643
content-length: 0
expires: 0

GET
H2 200 4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js Show response
pagead2.googlesyndication.com/bg/ Frame BAE2 37 KB
15 KB 81ms
80ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e102462cd94a7e7573dd74233c5f56d3770f732649a2b1d3eff05775d082b013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:18:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 332996
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14648
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:18:14 GMT

GET
H2 200 vpp.gif
finclan.com/detroitchicago/ 43 B
74 B 78ms
77ms Image
image/gif 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://finclan.com/detroitchicago/vpp.gif?e=%5B%7B%22url%22%3A%22https%3A%2F%2Ffinclan.com%2F%22%2C%22pageview_id%22%3A%2278598779-2a9f-4e5f-44e0-7333b4318a7a%22%2C%22template_id%22%3A134%2C%22player_name%22%3A%22ezoicvideo%22%2C%22domain_id%22%3A152251%2C%22media_src%22%3A%22blob%3Ahttps%3A%2F%2Ffinclan.com%2Fd83bbecd-ff0f-4fab-b3c6-109446bed8e4%22%7D%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
content-encoding: br
vary: Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 47
expires: Sun, 15 Oct 2023 14:48:10 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame BAE2 0
10 B 57ms
57ms Image
text/plain 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?9tcblg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:10 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 7BC9 0
0 120ms
120ms Image
text/html 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202310110101&jk=4285497030006294&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 115ms
114ms Image
text/html 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202310110101&jk=4285497030006294&bg=!oqGloe7NAAbFpEfJ5aQ7ADQBe5WfOCMSbicudJinB4R-cATcV4_VwrvJUoUUQYnSZafAby0dI4ElklCsBR-HUKvffjSiAgAAAEdSAAAABmgBBwoAXfWFaaZxxXhIdUCNPgvXqa4f2IbjVebcdKH3fUwMgk0u4CVqOcX83Otr6vw5yMINTVPd054IGiUfS2rcF-Y8V7QDWJhgrxl6AR2SUO0CgRxIdsJqsYCWItz9mutcypkC6sb4A7Og4HlRa40hcait5JtMRs5EmXBEcIpfeDKvOB4pCVcW2__tEDlHfRDoej7Ocv8Sv3Colu6v15dFFcua7ikg6-cA8-E0bJQdetTZei6akXZ1ekY_vaS1gTyhcIiL8w3jJJCnrXuUGnZDM8LnLWzgnlwjSqmkswlge6cE25S0czT-kEgE9SEuQQ65LZhO50u6ruzgvGS1xVkcgZnvXXuFcOLTFhTpT4-PZmDYXO2YlhfEes4pdl6ObpZMZHqohwUmYHOY21m5H1NdgYHv32EUy14EKh9jksbLH-CM2YVRyRexAz8kHfXSsXxWFu-0uiQ4Gx2OTdY6sU9FK2m2zYmZ_nsRrkOyMbx52IZytxKoMgM-ohZFQSmDzyfUPjEG8dmxgxrc5c_Wt9IQyXcajtrEMN-jTFp56GEzei_k9Mv8aLwtPto6Ndg1c7HypBh49RmKGoPUxpIPLXE7W-Eo_tkExbljDCk5FNxY0sQSixTiSYlTyXAgUzfzTQp5AWoYsa014SLRemXzN7XP_rCfa8UH-TNQitz-4sA_VGo0hxRUFmzGgFPvqRlghYSk8_24OYg45YpSDySj8OAmCkIMncRqa3oTxQySbZUcyO2KMdk7UJdIG-6O6CPFVFRdQLnETeu35RNTVnkAd64eczi6D8vrw_7xEB7f5x5YOWqNZjOT6Z8Rr5aFD0Ar8Y1wYEns2tsg8c7OET-7R2DT5Ce2tFIhiJ8CARHyQbKwiIV6EhBteKOTKYrbUxA_KyZXIUKJJA6kioC2k4VLhFiMjvMd3FZ8OBOoDSh-S33KB5DCIMlDan-4KpXj1-bnsl_f5dWDWt2sg0vq3xQzX9zTQy40qbdicWRhcHSC_8hbAfgVOYPnyiueKoXM7ho8pVj6FLtyOYpT4ou9rFBd_m_NRTHiwlmyWZe_9yvn3zLvuPff7FCr0j4hUn5Eg5-pDKoSg97DQWJaJ3wu9oyMm7UOTQcYjLFH3F_-9bs7u3te
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
22 KB 773ms
772ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3258080120167495&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=10&didk=3890690224&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691637&lmt=1697492891&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=a&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=iid1%3D4104119500757248%26tap%3Dfinclan_com-pixel1-4104119500757248%26bra%3Dmod233-c%26reft%3Dn%26eb_br%3Dzero%26ga%3D2497208%26ic%3D2%26ezoic%3D1%26avc%3D340%26br1%3D0%26br2%3D350%26bvr%3D0%26al%3D1006%26ap%3D9999%26d%3D152251%26lb%3D500%26at%3Dbf%26ss38%3D1%26ss9%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=1856613868&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84a118d3cca623fe9b2a279262561eb659836a888d30a89bacea5608de6da858

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22490
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
165 B 649ms
648ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1670874592572188&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=11&didk=2618579448&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691641&lmt=1697492891&adxs=315&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D180%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D350%26reqt%3D1697467691627&cust_params=amznbid%3D0%26amznp%3D0&adks=414029443&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7be0b1c1de2418edc91fc0f5b22dfe20b56cf898b7fb3f0d35f871c9563ca5e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 315 B
164 B 160ms
159ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1743752039694628&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1%7C1x1%7C1x1&ifi=12&didk=1059404481&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691645&lmt=1697492891&adxs=566&adys=949&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x91&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D3453499716755464%26eid%3D3453499716755464%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1021%26sap%3D1320%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dfinclan_com-medrectangle-3-3453499716755464%26eb_br%3D43aa1607a0c08c74b14a9039e7b909b4%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D217%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D220%26br2%3D220%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%26ax_ssid%3D10082%26lb%3D450%26reqt%3D1697467691615&cust_params=amznbid%3D0%26amznp%3D0&adks=735801982&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64a5efa57ccb09eacfff609bc1939cc0aea31fdeceff88c9264e89c5744f1442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:11 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 383 B
167 B 643ms
643ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=988384792162048&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=13&didk=3980648260&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691648&lmt=1697492891&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D9062749612755322%26eid%3D9062749612755322%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1975%26sap%3D1975%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dfinclan_com-edge-1-9062749612755322%26eb_br%3D86802a923a1f32517e4c5d3b6d550271%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D184%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D200%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4184%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C9%2C10%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D135e53e35cb6b75e%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.82%26hb_rt%3Dclient%26lb%3D400%26reqt%3D1697467691609&cust_params=amznbid%3D0%26amznp%3D0&adks=2043483273&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

501f12146a823643ab9c0a9bdb8ef8fa442439e13796eaddf26aa90dd58b8efa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
166 B 638ms
638ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=191503881889439&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=14&didk=1483115519&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691651&lmt=1697492891&adxs=638&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D180%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D350%26reqt%3D1697467691623&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209332&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c3cbee55586d029600606797500086e4137c55891d295ee053cc5953c6624f42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 383 B
167 B 641ms
641ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=673678661315358&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=15&didk=3980644605&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691654&lmt=1697492891&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D2628239510760259%26eid%3D2628239510760259%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1976%26sap%3D1976%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dfinclan_com-edge-2-2628239510760259%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D190%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D180%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%26ax_ssid%3D10082%26hb_bidder%3Donetag%26hb_adid%3D1307f78e5eb66b31%26hb_format%3Dbanner%26hb_ssid%3D11291%26hb_opt%3D0.56%26hb_rt%3Dclient%26lb%3D350%26reqt%3D1697467691599&cust_params=amznbid%3D0%26amznp%3D0&adks=1968572909&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daae14996340ebc02955a5a9f5e0e39d6efce85f69c5f6871ae75a1395c3463e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 381 B
164 B 643ms
643ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=472182270353301&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ifi=16&didk=2618578417&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691657&lmt=1697492891&adxs=566&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x60&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D7369173194762219%26eid%3D7369173194762219%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1114%26sap%3D1114%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dfinclan_com-box-3-7369173194762219%26eb_br%3Dc16fac08e79a971524b1c6834f5caad3%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D234%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D280%26br2%3D280%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2764%2C2765%2C3455%2C3456%2C3684%2C4184%2C9%2C10%2C11%26ax_ssid%3D10082%26lb%3D550%26reqt%3D1697467691612&cust_params=amznbid%3D0%26amznp%3D0&adks=3394468990&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66666cdfa99745bb9953d56cda0543080c7a0337ea7f56c5ba1088ed82bd6aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
165 B 630ms
630ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3644709635369661&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=17&didk=1483115518&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691661&lmt=1697492891&adxs=962&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D180%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D350%26reqt%3D1697467691619&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209333&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c908cee29ea080e0c2e2678e7eb33da2dc49e50a788a2fda4b8463e6dc979ac7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
176 B 662ms
662ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=4083174687197798&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=18&didk=1059391305&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467691664&lmt=1697492891&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D8831122984812716%26eid%3D8831122984812716%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dfinclan_com-medrectangle-2-8831122984812716%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D15%26bvm%3D0%26bvr%3D5%26avc%3D153%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D180%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C57%2C66%2C20%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D1348c6e7204dd518%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.91%26hb_rt%3Dclient%26lb%3D350%26reqt%3D1697467691605&cust_params=amznbid%3D0%26amznp%3D0&adks=1011857618&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93b6e366ac48d2fe88539ce212679054feffb5f9e2e1da3ae9ae124135aadb59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FB85 6 KB
3 KB 61ms
60ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:09 GMT
expires: Tue, 15 Oct 2024 14:48:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 greenoaks.gif
finclan.com/detroitchicago/ 0
62 B 57ms
56ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjIxNiJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiMTU5MCJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiNDMifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMzYxIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMzY3In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjI1NjMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiIxOTYwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiIxOTYwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZWZmZWN0aXZlX3R5cGUiLCJ2YWwiOiI0ZyJ9XX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:12 GMT

POST
H2 204 greenoaks.gif
finclan.com/detroitchicago/ 0
16 B 130ms
129ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjkuMSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjQ5OTkifV19XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:12 GMT

GET
H3 200 ezadfilled.js Show response
go.ezodn.com/porpoiseant/ 3 KB
2 KB 61ms
60ms Script
application/javascript 2606:4700:e2::ac40:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/ezadfilled.js?gcb=195-2&cb=120
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:890f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adbd4855a8c8b406e9f528883f91e4cad19d3051400f5bdba7dadf446a8d6815

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2023 22:28:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 231059
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0AwWCDMn5iKx%2Bl4vC0xK4QfzhOzpwFCMreFtNMN8aUbAV6kg%2BJ1QPOcbTAaRqt3WvVSmoXCT4n5zUdTeCw4jxlSCHg4QFnRxTWRUJRulhqAmGGHjs5uhoWabYgdNmVgrS56LBKVS9EqzvhE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 817119f5f94c2d19-ORD
alt-svc: h3=":443"; ma=86400

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 129ms
128ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDEwNDExOTUwMDc1NzI0OCIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJmaW5jbGFuX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQxMDQxMTk1MDA3NTcyNDgiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZmluY2xhbl9jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Inplcm8ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQxMDQxMTk1MDA3NTcyNDgiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZmluY2xhbl9jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0MTA0MTE5NTAwNzU3MjQ4IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImZpbmNsYW5fY29tLXBpeGVsMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODI0NjEwNTg0MiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDEwNDExOTUwMDc1NzI0OCIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJmaW5jbGFuX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0ODE3NzM1NDIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:12 GMT

GET
H3 200 4817735420 Show response
go.ezodn.com/dac/ 0
608 B 93ms
92ms XHR
text/plain 2606:4700:e2::ac40:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/4817735420
Requested by: Host: finclan.com
URL: https://finclan.com/porpoiseant/banger.js?cb=195-2&bv=276&v=99&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 0
last-modified: Mon, 16 Oct 2023 13:49:27 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://finclan.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yM%2F4afdcBgCbwtladxs5xaMVs8o9zGU8Q%2B2xaXbXppCFVGebtZLJ3rRuPlIKwpCVLxN5XrEGTvXDjpRH8lbQHu1PdwX8b9vIGEoM89ydxAeHscruOgmnI%2F%2BVKf1dCY03zfgClrZUjDvzp6E%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 817119f5f81729a0-ORD
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 129ms
128ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDEwNDExOTUwMDc1NzI0OCIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJmaW5jbGFuX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMC0xNiJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiI0MjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:12 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 129ms
128ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDEwNDExOTUwMDc1NzI0OCIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJmaW5jbGFuX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhdWN0aW9uX2Vwb2NoIjoxNjk3NDY3NjkyLCJhZF9wb3NpdGlvbiI6OTk5OSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImJpZF9mbG9vcl9pbml0aWFsIjo1MDAsImJpZF9mbG9vcl9wcmV2Ijo1MDAsImJpZF9mbG9vcl9maWxsZWQiOjAsImF1Y3Rpb25fY291bnQiOjIsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjc5OSwibXVsdGlfYWRfdW5pdCI6bnVsbCwibXVsdGlfYWRfY291bnQiOm51bGwsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjo0ODE3NzM1NDIwfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:12 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame FB85 4 KB
924 B 67ms
66ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 13:07:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Oct 2023 14:48:12 GMT

GET
H2 200 widget.js Show response
widgets.outbrain.com/n2d/widget/ Frame 8FF2 46 KB
12 KB 355ms
119ms Script
application/x-javascript 23.207.57.76
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/n2d/widget/widget.js
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.57.76 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-57-76.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 18d8329b2e4b430a4f34b5247ba02ca5378fcdf574eb7ba5f1ef00ac0a705c5a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: gzip
content-length: 11833
last-modified: Tue, 22 Aug 2023 10:30:48 GMT
server: AkamaiNetStorage
etag: "6a7ff93f96fd30914785c7c30706bf6a:1692700788.526954"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Mon, 16 Oct 2023 18:48:12 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 8FF2 3 KB
1 KB 57ms
57ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 8FF2 20 KB
8 KB 59ms
58ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:26:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1312
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 14:26:20 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8FF2 0
0 71ms
69ms Image
text/html 2607:f8b0:4004:c06::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRKBH8y_DjhJ7A2XXQjoraBSuRmsP16SgwId_5IAqjSgDsii2gi_2uAAxCMXRIHExrGJ0R2vsgBbAby6GayiF2L6xnp2Q
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c06::63 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 8FF2 24 KB
6 KB 80ms
79ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sat, 14 Oct 2023 11:15:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 185574
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 13 Oct 2024 11:15:18 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8FF2 187 KB
59 KB 1185ms
1183ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:13 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame FB85 20 KB
8 KB 66ms
66ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e08fab994eb10dfab342ea8c594178451e92a54746244e47f90d513c187ae228

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:07:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8568
x-xss-protection: 0
server: cafe
etag: 3657364187347500438
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 12:07:17 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 296ms
118ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ffinclan.com%2F&domain=finclan.com&cw=1&pbt=1&lsw=1&us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://finclan.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://finclan.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 16 Oct 2023 14:48:11 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 334511
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET /
id.a-mx.com/sync/ 0
0

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58713/ 391 B
480 B 310ms
102ms Fetch
application/json 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=1---&url=https://finclan.com/&pixelId=58713

Requested by

Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

cb828e46fd53d03da3507d036a842b7a4126315d414bd9866721fe734ce3f778

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://finclan.com
content-type: application/json
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ffinclan.com%2F&domain=finclan.com&cw=1&pbt=1&lsw=1&us_privacy=1---
https://mug.criteo.com/sid?cpp=XswJ2nxNbTl6eGIvTWtJclc5UmRNUi9JL3VER0x1VVZZVnY2KzdOcTBZUVVOWXV2OGhrMGgzZ1hrWkVMVlZIaVl4QTMrelFzRFIvempveVN0OXJ2ZUlSQks5Y0xEa1daYlpPVVQ4bHVnaWwwSm1xdHFQb2xlOStiVE5Rd2...

428 B
694 B

84ms
83ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=XswJ2nxNbTl6eGIvTWtJclc5UmRNUi9JL3VER0x1VVZZVnY2KzdOcTBZUVVOWXV2OGhrMGgzZ1hrWkVMVlZIaVl4QTMrelFzRFIvempveVN0OXJ2ZUlSQks5Y0xEa1daYlpPVVQ4bHVnaWwwSm1xdHFQb2xlOStiVE5Rd2lIRjFjbFRoaEhDazkxOERQS0tOZUFzZUlvVDMzRzdoSzNheTZ2OXNwYllpZCtEbTdsQ0dlSUxoLzkvZGNQRFdwY0NIMUtva2hvdTlxcUhJUUNKd0h0WDlBQ1FyLzM2R29UUXRxTnJOZkxvODFJMFdHQnVUTkNFUWQ2c2pUMUJYU1ZnaEk5c2RTRjFtaWtUU1RDVEpjZ0JocUk0emlHUT09fA&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

374abd8c763c806d2ca73292f341b12049955f1ac3ade4f552379b903f324949

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 869276
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
access-control-allow-origin: https://finclan.com
location: https://mug.criteo.com/sid?cpp=XswJ2nxNbTl6eGIvTWtJclc5UmRNUi9JL3VER0x1VVZZVnY2KzdOcTBZUVVOWXV2OGhrMGgzZ1hrWkVMVlZIaVl4QTMrelFzRFIvempveVN0OXJ2ZUlSQks5Y0xEa1daYlpPVVQ4bHVnaWwwSm1xdHFQb2xlOStiVE5Rd2lIRjFjbFRoaEhDazkxOERQS0tOZUFzZUlvVDMzRzdoSzNheTZ2OXNwYllpZCtEbTdsQ0dlSUxoLzkvZGNQRFdwY0NIMUtva2hvdTlxcUhJUUNKd0h0WDlBQ1FyLzM2R29UUXRxTnJOZkxvODFJMFdHQnVUTkNFUWQ2c2pUMUJYU1ZnaEk5c2RTRjFtaWtUU1RDVEpjZ0JocUk0emlHUT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 352006
content-length: 0
expires: 0

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 141 B
197 B 52ms
52ms Fetch
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9a12fd2d5c0cd80a68f7c5b1be9d6cf29dede3933eb6441aaa377c20fab5be9

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-encoding: gzip
server: cloudflare
allow: POST, OPTIONS, GET
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cf-ray: 817119f71d4da1ea-YYZ
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
411 B 174ms
174ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e6cead609d342bd202f23b8fa86aff54f2503372d68ae63acca87e7dca2bec15

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
899 B 70ms
67ms Fetch
application/json 34.233.138.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?us_privacy=1---
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.138.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-138-61.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 20b08fee172e2901c786acf421672fcd41d8f922578c0fb021e1a78b5b43316b

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://finclan.com
cache-control: no-cache
x-server: 10.40.38.22
access-control-allow-credentials: true
content-length: 152
expires: 0

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 71B7 37 KB
12 KB 419ms
172ms Document
text/html 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

13ed6d5a02a02d05ccb11fe06ee5426edd8e68cfb851a78e9cbeb6ee13b76347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 12404
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: Wed, 18 Oct 2023 14:48:13 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 855A 4 KB
2 KB 46ms
46ms Document
text/html 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

fe2c4f29be72a7a9a0366193287b74edf4a5a54bbb6fbb401e5d2b83ed0c6ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1380
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6267 52 KB
17 KB 193ms
36ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 17546
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 16 Oct 2023 14:48:12 GMT
ETag: W/"623de86a-cf34"
Expires: Sun, 01 Oct 2023 09:55:16 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 165, 44002
X-Served-By: cache-lga13626-LGA, cache-yyz4553-YYZ
X-Timer: S1697467693.825739,VS0,VE0

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 3D49 3 KB
2 KB 206ms
51ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 401
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 817119f82e0aa24a-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:12 GMT
expires: Mon, 16 Oct 2023 18:48:12 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 isyn Show response
prebid.a-mo.net/ Frame 5471 2 KB
781 B 51ms
51ms Document
text/html 147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=_e%3DCrABSgtmaW5jbGFuLmNvbVILYWFzLWM4YTUyN2VaCHBiYTEuMy4zagtmaW5jbGFuLmNvbfoBBjguMTYuMOgCAYgDqJq1qQaoAyXqAyQyNWE0ZmVjZi1kNDlkLTQ1YmEtYWFhZS03NDkxYmQ1YzkxMGOqBANEQ0iyBQNVU0TSBQkxMDUxOTkzMzXYBQHgBQHqBQdkZXNrdG9w-gUDbnk1qgcDd2ViygcLZmluY2xhbi5jb20
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: ac288f5e03d0cc7840feab2336ce5097ef07481be901033c43d5171a71f8ade4

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 692
content-type: text/html; charset=utf-8
date: Mon, 16 Oct 2023 14:48:12 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

GET
H2

200

visitormatch Show response
bh.contextweb.com/ Frame FFD8
Redirect Chain

https://bh.contextweb.com/visitormatch
https://bh.contextweb.com/visitormatch?reat=1

4 KB
4 KB

133ms
133ms

Document
text/html

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch?reat=1

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

7a93fc6f344be73e8fab69c63ed1fc2cc62c2248a5a94ff67c726441fe1f6a65

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-CA
content-length: 3712
content-type: text/html;charset=iso-8859-1
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-CA
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1
location: /visitormatch?reat=1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 3F03 281 B
554 B 365ms
154ms Document
text/html 104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 16 Oct 2023 14:48:12 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 / Show response
csync.smilewanted.com/ Frame 41C5 6 KB
2 KB 173ms
168ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/?us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6417c65a57cd68bc0e5e18cf23b47ee22d6c9643d6b2987c6dbed425baebf25b

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 817119f74b6536d8-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:12 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2501 15 KB
6 KB 67ms
64ms Document
text/html 69.192.109.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.109.53 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-109-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=121582
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Mon, 16 Oct 2023 14:48:12 GMT
expires: Wed, 18 Oct 2023 00:34:34 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 isync Show response
visitor.omnitagjs.com/visitor/ Frame 83DB 5 KB
2 KB 110ms
81ms Document
text/html 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

f44ff757c4ea2bb277a5a2a54a5c0f270ca1d648286c3391da7eb6bc0fc8a1ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 1447
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:12 GMT
expires: 0
p3p: CP="CAO PSA OUR"
pragma: no-cache
server: ayl-lb-usa02
vary: Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 34

GET
H2 200 pd Show response
ezoic-d.openx.net/w/1.0/ Frame DF36 1 KB
951 B 55ms
43ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: d46dae6c11f44637fe6d19b755aa6c045d16c7210ff48b8d3d50488304270561

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 629
content-type: text/html
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1

200
OK

cookie
a.vidoomy.com/api/rtbserver/
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-vidoomy&gdpr=0&gdpr_consent=&us_privacy=
https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=LNT0FNR4-24-IKB9&gdpr=0

43 B
622 B

790ms
195ms

Image
image/gif

212.36.83.245
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=LNT0FNR4-24-IKB9&gdpr=0
Protocol: HTTP/1.1
Server: 212.36.83.245 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb1.vdmy.dtic.es
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Encoding: none
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 43

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=LNT0FNR4-24-IKB9&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H2 200 cookie
cm.adform.net/ 43 B
105 B 694ms
272ms Image
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadf%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H/1.1

200
OK

cookie
a.vidoomy.com/api/rtbserver/
Redirect Chain

https://x.bidswitch.net/sync?ssp=vidoomy&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=vidoomy&gdpr=0&gdpr_consent=&us_privacy=
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=vidoomy&bsw_custom_parameter=83f9e3fc-86a5-44e1-b9cd-eddbb8ca2bf6&gdpr=0&gdpr_consent=&gdpr_pd=
https://x.bidswitch.net/sync?dsp_id=413&ssp=vidoomy&user_id=csonata_a6d2d415-5e8a-4ff2-9e27-dfd92da45430&bsw_param=83f9e3fc-86a5-44e1-b9cd-eddbb8ca2bf6&expires=10&gdpr=0&gdpr_consent=&gdpr_pd=
https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=a77dcf3e-0a02-43b0-ba25-509c697b290e

43 B
650 B

385ms
164ms

Image
image/gif

212.36.83.245
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=a77dcf3e-0a02-43b0-ba25-509c697b290e
Protocol: HTTP/1.1
Server: 212.36.83.245 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb1.vdmy.dtic.es
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:14 GMT
Content-Encoding: none
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 43

Redirect headers

Location: //a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=a77dcf3e-0a02-43b0-ba25-509c697b290e
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

setuid
a-prebid.vidoomy.com/
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D$%7BUID%7D
https://a-prebid.vidoomy.com/setuid?bidder=openx&uid=a120b619-f1f5-48f6-924b-67dc22bc9bdc

0
571 B

797ms
182ms

Image
text/html

212.36.83.245
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a-prebid.vidoomy.com/setuid?bidder=openx&uid=a120b619-f1f5-48f6-924b-67dc22bc9bdc
Protocol: HTTP/1.1
Server: 212.36.83.245 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb1.vdmy.dtic.es
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: nginx
Vary: Accept-Encoding, Origin
Content-Type: text/html
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://a-prebid.vidoomy.com/setuid?bidder=openx&uid=a120b619-f1f5-48f6-924b-67dc22bc9bdc
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 116

GET
H/1.1

200
OK

cookie
a.vidoomy.com/api/rtbserver/
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=120&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D%7BuserId%7D
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=120&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D%7BuserId%7D
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341&partner_url=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3D...
https://a.vidoomy.com/api/rtbserver/cookie?i=CEN&uid=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341

43 B
670 B

540ms
188ms

Image
image/gif

212.36.83.245
AS_ADAM Adam Data...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.vidoomy.com/api/rtbserver/cookie?i=CEN&uid=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341
Protocol: HTTP/1.1
Server: 212.36.83.245 Terrassa, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS: lb1.vdmy.dtic.es
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Encoding: none
Server: nginx
Access-Control-Allow-Methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-VD-C
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 43

Redirect headers

date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://a.vidoomy.com/api/rtbserver/cookie?i=CEN&uid=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 855A
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=e1a4652d-4d2c-4700-82f4-9ec27c2cfa0a&gdpr=1&gdpr_consent=

0
291 B

64ms
63ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=e1a4652d-4d2c-4700-82f4-9ec27c2cfa0a&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Mon, 16 Oct 2023 14:48:12 GMT
Server: MT3 1075 283b7e3 master ord ord-pixel-x48 config_version:"1969"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=e1a4652d-4d2c-4700-82f4-9ec27c2cfa0a&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 16 Oct 2023 14:48:11 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 855A 0
239 B 636ms
147ms Image
image/gif 213.19.162.80
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 213.19.162.80 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: deb9f124eecce7a554c70ca983265c95
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 855A
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=4396685237194775250

0
291 B

54ms
53ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=4396685237194775250

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
an-x-request-uuid: 2fca4536-a88b-4af3-b0b8-8df9dc79c722
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=4396685237194775250
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 855A
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=3&uid=78d4f41415bb274fb0eb21d9e9d1d116&gdpr_consent=&gdpr=1

0
291 B

61ms
58ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=3&uid=78d4f41415bb274fb0eb21d9e9d1d116&gdpr_consent=&gdpr=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=3&uid=78d4f41415bb274fb0eb21d9e9d1d116&gdpr_consent=&gdpr=1
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1697467692974097-299

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 855A 42 B
703 B 341ms
63ms Image
image/gif 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=mgQthVKzJie2_diUa11hnG6775UJZQ6nYduftnWfUfo
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 855A
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1drsPqDfoDYRt52X8WhcrlkXe5IZwtw

170 B
188 B

72ms
72ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1drsPqDfoDYRt52X8WhcrlkXe5IZwtw

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1drsPqDfoDYRt52X8WhcrlkXe5IZwtw
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ Frame 855A 0
45 B 388ms
75ms Image
text/plain 216.22.16.53
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 216.22.16.53 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 855A
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=4Ec2Rssh9MdxdMjGaFvIrfVYhMH_RHOf_IluIVkm2-w

43 B
479 B

67ms
67ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=4Ec2Rssh9MdxdMjGaFvIrfVYhMH_RHOf_IluIVkm2-w

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ZF1MAQDD6Z29JAA9Y3K7
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=4Ec2Rssh9MdxdMjGaFvIrfVYhMH_RHOf_IluIVkm2-w
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 855A 0
42 B 288ms
67ms Image
text/plain 8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=1---&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 855A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

0
291 B

50ms
50ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame 855A 0
125 B 234ms
101ms Image
text/plain 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 855A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=

0
291 B

53ms
52ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

server-3-162-103-61.iad61.r.cloudfront.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=
date: Mon, 16 Oct 2023 14:48:12 GMT
server: Kestrel
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 855A 43 B
235 B 440ms
137ms Image
image/gif 35.211.178.172
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1697467688671&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 5471 12 KB
5 KB 214ms
50ms Script
text/javascript 2606:4700::6813:9e13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=_e%3DCrABSgtmaW5jbGFuLmNvbVILYWFzLWM4YTUyN2VaCHBiYTEuMy4zagtmaW5jbGFuLmNvbfoBBjguMTYuMOgCAYgDqJq1qQaoAyXqAyQyNWE0ZmVjZi1kNDlkLTQ1YmEtYWFhZS03NDkxYmQ1YzkxMGOqBANEQ0iyBQNVU0TSBQkxMDUxOTkzMzXYBQHgBQHqBQdkZXNrdG9w-gUDbnk1qgcDd2ViygcLZmluY2xhbi5jb20
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9e13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d7f9289b9e9b768f4add47941d29f127d5e3343774de111f7e68a9af81e33f2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
via: 1.1 aeb5666323839aae474c4500b3f9dd82.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: YUL62-C1
age: 501
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 13 Oct 2023 17:01:58 GMT
server: cloudflare
etag: W/"d89490fe715814f9971fe560ac2c7b5c"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 817119f88db3a223-YYZ
x-amz-cf-id: NxGROrOSx_FcCtep6_ZiVviO7IMlN0BoBt2Q42Zs3mvs_VZswYe6-g==
expires: Mon, 16 Oct 2023 15:48:12 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 2501 5 KB
6 KB 314ms
88ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=94688856&p=156983&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: a02e605db77ad209aec11b150a2396aa0e0cdcb0ebc8dedf906bd12310716719

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%26ttl%3D720%26uid%3D48d5713d5c563cba2049f505b2d944b6%26vis...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=4396685237194775250&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

49 B
180 B

71ms
68ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=4396685237194775250&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
an-x-request-uuid: 30499c55-d5db-43a9-bbf0-a1689bfad0ff
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=4396685237194775250&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%2B-%2BBanner%26ttl%3D720%26uid%3D75d56568a11564bfb79a01d2f...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=4396685237194775250&gdpr=0&gdpr_consent=&gdpr=0&gdpr_c...

49 B
180 B

63ms
62ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=4396685237194775250&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 4
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
an-x-request-uuid: b86cf885-ada6-4bf8-8e88-260334a21b25
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=4396685237194775250&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 ayl_pixel
api-2-0.spot.im/pixels/ Frame 83DB 0
456 B 316ms
116ms Image
text/plain 3.162.103.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://api-2-0.spot.im/pixels/ayl_pixel?ayl_id=916c7d08598eb7031c46b0688669d85b

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.162.103.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; img-src 'self'; script-src-elem connect.facebook.net; style-src-elem 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; report-uri https://o294277.ingest.sentry.io/api/4505425533272064/security/?sentry_key=f16f012f16c94b179d820f4d5e9c39ff
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 5e6930ff15cb9ece8bd1c3b20d8103c0.cloudfront.net (CloudFront)
content-security-policy: default-src 'none'; img-src 'self'; script-src-elem connect.facebook.net; style-src-elem 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; report-uri https://o294277.ingest.sentry.io/api/4505425533272064/security/?sentry_key=f16f012f16c94b179d820f4d5e9c39ff
strict-transport-security: max-age=31536000
x-amz-cf-pop: IAD61-P1
x-amz-cf-id: Om754SUqwm8G-FDklBgCrleBry8kSOJmMrFO1pusGTUmKiqN5vhnNg==
x-cache: Miss from cloudfront

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://x.bidswitch.net/sync?ssp=adyoulike&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=adyoulike&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=adyoulike
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=adyoulike
https://x.bidswitch.net/sync?dsp_id=70&user_id=6499063401832923204&ssp=adyoulike
https://visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=a77dcf3e-0a02-43b0-ba25-509c697b290e&name=BIDSWITCH&gdpr=&gdpr_consent=

49 B
178 B

55ms
54ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=a77dcf3e-0a02-43b0-ba25-509c697b290e&name=BIDSWITCH&gdpr=&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

Location: //visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=a77dcf3e-0a02-43b0-ba25-509c697b290e&name=BIDSWITCH&gdpr=&gdpr_consent=
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=CdyqZSXAe06l8R6C0T6G&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1

49 B
178 B

121ms
121ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=CdyqZSXAe06l8R6C0T6G&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=CdyqZSXAe06l8R6C0T6G&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT, Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://csync.smilewanted.com/getuid?source=openrtb&zoneCode=openrtb_adyoulike&redirect=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSMILE_WANTED%26ttl%3D720%26uid%3De77031af...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=318c3440e57c2d44e2bf4548337550f2&gdpr=0&gdpr_consent=

49 B
178 B

57ms
52ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=318c3440e57c2d44e2bf4548337550f2&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=318c3440e57c2d44e2bf4548337550f2&gdpr=0&gdpr_consent=
access-control-allow-credentials: true
cf-ray: 817119f80d6836d8-YYZ
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://match.prod.bidr.io/cookie-sync/aul
https://match.prod.bidr.io/cookie-sync/aul?_bee_ppp=1
https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AAJZ7E7KWpoAABxo6KAAXg&name=BEESWAX

49 B
178 B

57ms
57ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AAJZ7E7KWpoAABxo6KAAXg&name=BEESWAX

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AAJZ7E7KWpoAABxo6KAAXg&name=BEESWAX
Date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent=
https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&name=THE_TRADE_DESK

49 B
178 B

80ms
77ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&name=THE_TRADE_DESK

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&name=THE_TRADE_DESK
date: Mon, 16 Oct 2023 14:48:12 GMT
server: Kestrel
content-length: 319

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://csync.loopme.me/?pubid=11480&redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3D68c72dd412a8d0f3f6d2276db2509939%26name%3DLOOPME%26visitor%3D%7Bdevice_id%7D%0A&gdpr=0&gdp...
https://visitor.omnitagjs.com/visitor/sync?uid=68c72dd412a8d0f3f6d2276db2509939&name=LOOPME&visitor=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3%20&gdpr_consent=null&gdpr=0

49 B
178 B

105ms
105ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=68c72dd412a8d0f3f6d2276db2509939&name=LOOPME&visitor=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3%20&gdpr_consent=null&gdpr=0

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=68c72dd412a8d0f3f6d2276db2509939&name=LOOPME&visitor=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3 &gdpr_consent=null&gdpr=0
date: Mon, 16 Oct 2023 14:48:13 GMT
server: _
content-length: 0

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_NATIVE_1_2%26ttl%3D720%26uid%3Df2d9136cf53dede7f83ba16171a37fdd%26visit...
https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_NATIVE_1_2%26ttl%3D720%26uid%3Df2d9136cf53dede7f83ba16171a37fdd%26visit...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=-DO3LFenhTo6u7eTibx6&gdpr=0&gdpr_consent=&gdpr=0

49 B
181 B

130ms
129ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=-DO3LFenhTo6u7eTibx6&gdpr=0&gdpr_consent=&gdpr=0

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 3
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=-DO3LFenhTo6u7eTibx6&gdpr=0&gdpr_consent=&gdpr=0
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 221
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 83DB
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0RFRTAyNzEtNzg3Mi00N0IxLThBRjEtNUVDNjdEODlBOUU4&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=4396685237194775250
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
59 B

137ms
136ms

Image
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---
Protocol: H2
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET adyoulike
sync.adotmob.com/cookie/ Frame 83DB 0
0

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=33&gdpr=0&gdpr_consent=
https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-15768347-f909-5c9e-44a9-d01afd5115db$ip$70.28.97.142&name=STACKADAPT&gdpr=0&gdpr_consent=

49 B
178 B

75ms
74ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-15768347-f909-5c9e-44a9-d01afd5115db$ip$70.28.97.142&name=STACKADAPT&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

Location: https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-15768347-f909-5c9e-44a9-d01afd5115db$ip$70.28.97.142&name=STACKADAPT&gdpr=0&gdpr_consent=
Date: Mon, 16 Oct 2023 14:48:13 GMT
Connection: keep-alive
Content-Length: 218
Content-Type: text/html; charset=utf-8

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://inv-nets.admixer.net/adxcm.aspx?ssp=5E789729-1E92-41CA-8B4F-987C6EDAE9FE&rurl=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADMIXER%26ttl%3D720%26uid%3D0f4b0fcde45fe67...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=de003824833f4cec86ed7d38dbb31f4c&gdpr=0&gdpr_consent=

49 B
178 B

62ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=de003824833f4cec86ed7d38dbb31f4c&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: *
Location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=de003824833f4cec86ed7d38dbb31f4c&gdpr=0&gdpr_consent=
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=25
Content-Length: 0
X-Xss-Protection: 0

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 83DB 0
277 B 340ms
141ms Image
text/plain 63.251.114.182
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSOVRN%26ttl%3D720%26uid%3D4b30a0b1f289a261ab592e1e53c126eb%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.114.182 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 16 Oct 2023 14:48:13 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

200

sync
visitor-usa02.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://jadserve.postrelease.com/suid/101967?ntv_r=https%3A%2F%2Fvisitor-usa02.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DNATIVO%26ttl%3D720%26uid%3D0544850a0778385701c6899403bef718%26visitor%3DNTV_US...
https://visitor-usa02.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=f124bdec-aded-4c05-bd17-729ac64928f6&gdpr=0&gdpr_consent=

49 B
178 B

50ms
49ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor-usa02.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=f124bdec-aded-4c05-bd17-729ac64928f6&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://visitor-usa02.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=f124bdec-aded-4c05-bd17-729ac64928f6&gdpr=0&gdpr_consent=
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEEN...
https://ads.betweendigital.com/match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEEN...
https://visitor.omnitagjs.com/visitor/sync?uid=bf39a6af2a15b80f82f7ff725f351919&visitor=e44e40eb-782a-5321-bf2b-ea92da06a7bf&name=BETWEENX&gdpr=0&gdpr_consent=

49 B
180 B

62ms
61ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=bf39a6af2a15b80f82f7ff725f351919&visitor=e44e40eb-782a-5321-bf2b-ea92da06a7bf&name=BETWEENX&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 8
content-length: 49
expires: 0

Redirect headers

location: https://visitor.omnitagjs.com/visitor/sync?uid=bf39a6af2a15b80f82f7ff725f351919&visitor=e44e40eb-782a-5321-bf2b-ea92da06a7bf&name=BETWEENX&gdpr=0&gdpr_consent=
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 83DB
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=6b2595d5-cf4e-4298-a4ac-bcc34433eaad&secure=1&gdpr=0&gdpr_consent=
https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=35911f03-5fc3-4d21-bcf7-789dc6d6f3a8&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}

49 B
178 B

85ms
85ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=35911f03-5fc3-4d21-bcf7-789dc6d6f3a8&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
content-length: 49
expires: 0

Redirect headers

x-servername: Track003-iad
pragma: no-cache
date: Mon, 16 Oct 2023 14:47:35 GMT
strict-transport-security: max-age=31536000;
content-type: text/html; charset=utf-8
location: https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=35911f03-5fc3-4d21-bcf7-789dc6d6f3a8&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
cache-control: private,no-cache
content-length: 315
expires: -1

GET
H2 200 711333.gif
id.rlcdn.com/ Frame 83DB 42 B
306 B 68ms
67ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711333.gif?&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://visitor.omnitagjs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame AC6D
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=

281 B
554 B

218ms
74ms

Document
text/html

104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 16 Oct 2023 14:48:13 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame D02B 4 KB
2 KB 46ms
46ms Document
text/html 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

7fc8286b5e728ff87500ed9125e536f0d0451c7652b3a5b4aebce95c8ffa2f71

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1433
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 4D1C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=

281 B
554 B

147ms
76ms

Document
text/html

104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 16 Oct 2023 14:48:13 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
server: AkamaiGHost

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 9F75
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=

281 B
554 B

351ms
131ms

Document
text/html

104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 16 Oct 2023 14:48:13 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
server: AkamaiGHost

GET
H2 200 sync Show response
ssbsync.smartadserver.com/api/ Frame 25D4 673 B
877 B 335ms
121ms Document
text/html 23.105.12.143
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Requested by: Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.143 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 6c1992774ce86a89d631676ad8eb2d6eae105a95be59b10c2777d8ebabc142eb

Request headers

Referer: https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 673
content-type: text/html
date: Mon, 16 Oct 2023 14:48:12 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DF36
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=4&cm=87700d33-1a10-4751-8f52-3c8847d55760&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537073026%26val%3D%7Bvisitor_id%7D
https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:f5a9c99b9f8a55a7f0e60ec94a5e8263

43 B
61 B

59ms
57ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:f5a9c99b9f8a55a7f0e60ec94a5e8263
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 16 Oct 2023 14:48:13 GMT
server: Aorta/20231013.3e27223b3
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
location: https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:f5a9c99b9f8a55a7f0e60ec94a5e8263
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: bc798be2dcc0
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H3

200

dds
rtb.openx.net/sync/ Frame DF36
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=R6iz6uHswjEfs-t-cP5j6w==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
58 B

59ms
55ms

Image
image/gif

35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DF36
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=74179480-c063-401c-8595-aa803dd4fb5e

43 B
61 B

104ms
102ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=74179480-c063-401c-8595-aa803dd4fb5e
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=74179480-c063-401c-8595-aa803dd4fb5e
Date: Mon, 16 Oct 2023 14:48:13 GMT
Connection: keep-alive
X-CI-RTID: 61f59272-f2aa-4c45-ae6e-4d68402d5429
Content-Length: 112
Content-Type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DF36
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341&gdpr=0&gdpr_consent=

43 B
61 B

101ms
99ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341&gdpr=0&gdpr_consent=
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame DF36 95 B
124 B 80ms
78ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=9e804a2a-136d-4698-b326-3f1f906b985d

Requested by

Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58294/ Frame DF36 0
289 B 151ms
101ms Image
text/plain 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=b63aba5f-9000-4156-aae0-66c33444ad38

Requested by

Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

458249.gif
idsync.rlcdn.com/ Frame DF36
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=cd3846b0-852d-4d7f-a6be-273a9a7c3889
https://id.rlcdn.com/1000.gif?memo=CPaqHBIvCisIARCUaxokY2QzODQ2YjAtODUyZC00ZDdmLWE2YmUtMjczYTlhN2MzODg5EAAaDQitmrWpBhIFCOgHEABCAEoA
https://pippio.com/api/sync?pid=5324&it=1&iv=576a76d53db705e6df4ecb59eb75cfd39899ee0df82e156e2fbdd5bd770a5301791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA1NzZhNzZkNTNkYjcwNWU2ZGY0ZWNiNTllYjc1Y2ZkMzk4OTllZTBkZjgyZTE1NmUyZmJkZDViZDc3MGE1MzAxNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA1NzZhNzZkNTNkYjcwNWU2ZGY0ZWNiNTllYjc1Y2ZkMzk4OTllZTBkZjgyZTE1NmUyZmJkZDViZDc3MGE1MzAxNzkxNDI2YjU0MTdkY2UyMRAAGgwIrZq1qQYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=12bafcda-17b5-4c66-ab25-09fb94fc7973

42 B
306 B

59ms
57ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=12bafcda-17b5-4c66-ab25-09fb94fc7973
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H2
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
strict-transport-security: max-age=31536000
content-type: text/html; charset=utf-8
location: https://idsync.rlcdn.com/458249.gif?partner_uid=12bafcda-17b5-4c66-ab25-09fb94fc7973
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DF36
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=4396685237194775250

43 B
61 B

72ms
71ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=4396685237194775250
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
an-x-request-uuid: 18c62814-576c-4fb5-ae25-4d8ae0764cd5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=4396685237194775250
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DF36
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3192706110285620337&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

49ms
46ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3192706110285620337&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3192706110285620337&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET ny75r2x0
sync-tm.everesttech.net/upi/pid/ Frame DF36 0
0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
270 B 147ms
147ms Fetch
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

ec8159d6d118d148f6118bc72999407f9d704cfb0bdae7ab471018298da4fb1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D02B
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1d0VmDRvmyD4gmnJ9CmCqJ1oB_vRTWQ

170 B
188 B

78ms
77ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1d0VmDRvmyD4gmnJ9CmCqJ1oB_vRTWQ

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1d0VmDRvmyD4gmnJ9CmCqJ1oB_vRTWQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=ba0e652d-4d2d-4200-945f-ae1230ff7d32&gdpr=0&gdpr_consent=

0
291 B

64ms
60ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=ba0e652d-4d2d-4200-945f-ae1230ff7d32&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: MT3 1075 283b7e3 master ord ord-pixel-x53 config_version:"1969"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=ba0e652d-4d2d-4200-945f-ae1230ff7d32&gdpr=0&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 16 Oct 2023 14:48:12 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=2&uid=LNT0FNR4-24-IKB9&gdpr=0

0
291 B

68ms
63ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=2&uid=LNT0FNR4-24-IKB9&gdpr=0

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://onetag-sys.com/match/?int_id=2&uid=LNT0FNR4-24-IKB9&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: deb9f124eecce7a554c70ca983265c95
Expires: 0

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=4396685237194775250

0
291 B

59ms
58ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=4396685237194775250

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
an-x-request-uuid: 7ce4d192-24fa-4f6b-8493-7d143f971c8a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=4396685237194775250
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 504
Gateway Time-out user-matching
ads.stickyadstv.com/ Frame D02B 0
0 1291ms
1063ms Image
text/html 63.251.28.233
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-matching?id=3679&gdpr=0&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.251.28.233 Secaucus, United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame D02B 42 B
703 B 269ms
65ms Image
image/gif 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=4Ec2Rssh9MdxdMjGaFvIrfVYhMH_RHOf_IluIVkm2-w
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
https://onetag-sys.com/match/?int_id=107&uid=5579908648323020943

0
291 B

60ms
57ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=107&uid=5579908648323020943

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=107&uid=5579908648323020943
date: Mon, 16 Oct 2023 14:48:12 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame D02B
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=yUM4vts1AChrR55JQ7SMmNiLHYkiuj2K8gC2lQym-Po

43 B
479 B

65ms
63ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=yUM4vts1AChrR55JQ7SMmNiLHYkiuj2K8gC2lQym-Po

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 4RV0KYNC36BDF7J2PBQA
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=yUM4vts1AChrR55JQ7SMmNiLHYkiuj2K8gC2lQym-Po
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame D02B
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26u...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0RFRTAyNzEtNzg3Mi00N0IxLThBRjEtNUVDNjdEODlBOUU4&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=4396685237194775250
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
59 B

136ms
135ms

Image
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 19:41:55 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

0
291 B

99ms
97ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=92&uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A

0
291 B

92ms
92ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=92&uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=92&uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A
date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=

0
291 B

86ms
85ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=
date: Mon, 16 Oct 2023 14:48:12 GMT
server: Kestrel
content-length: 233

GET
H2

200

/
onetag-sys.com/match/ Frame D02B
Redirect Chain

https://x.bidswitch.net/sync?ssp=onetag&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=onetag&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=onetag&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&expires=30&ssp=onetag&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://onetag-sys.com/match/?int_id=30&uid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&us_privacy=

0
291 B

59ms
59ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=30&uid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&us_privacy=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location: //onetag-sys.com/match/?int_id=30&uid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&us_privacy=
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
visitor.omnitagjs.com/visitor/ Frame D02B 49 B
189 B 54ms
50ms Image
image/gif 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=f04f5c55f88ffea7a3ce5b2d908a6e71&visitor=4Ec2Rssh9MdxdMjGaFvIrfVYhMH_RHOf_IluIVkm2-w

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame FFD8
Redirect Chain

https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=&gdpr=0&gdpr_consent=
https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=41613799a1a013fe&is_secure=true&networkId=14200&version=1&nuid=&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAFydzZboTMhQMNwlcxAAAAAAA&expiration=1697554093&nuid=&is_secure=true&gdpr_consent=&gdpr=0

49 B
1018 B

84ms
84ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAFydzZboTMhQMNwlcxAAAAAAA&expiration=1697554093&nuid=&is_secure=true&gdpr_consent=&gdpr=0

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAFydzZboTMhQMNwlcxAAAAAAA&expiration=1697554093&nuid=&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame FFD8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=MVRReHBKcUNQeFVMWXZRY0xvVENoQQ&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBnouYOmTY58emoDUa159dw&google_cver=1

49 B
962 B

63ms
62ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBnouYOmTY58emoDUa159dw&google_cver=1

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBnouYOmTY58emoDUa159dw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 335
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame FFD8
Redirect Chain

https://x.bidswitch.net/sync?ssp=pulsepoint
https://x.bidswitch.net/ul_cb/sync?ssp=pulsepoint
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=pulsepoint&bsw_custom_parameter=f60d73ba-b134-4aab-95b7-6808086c4dfd&gdpr=&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=pulsepoint&bsw_custom_parameter=f60d73ba-b134-4aab-95b7-6808086c4dfd&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=40497a49-4ef4-42b8-ade5-3dc63b996a4f&ssp=pulsepoint&expires=30&user_group=5&bsw_param=f60d73ba-b134-4aab-95b7-6808086c4dfd
https://bh.contextweb.com/bh/rtset?do=add&pid=556010&ev=a77dcf3e-0a02-43b0-ba25-509c697b290e

49 B
1 KB

92ms
90ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=556010&ev=a77dcf3e-0a02-43b0-ba25-509c697b290e

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1

Redirect headers

Location: //bh.contextweb.com/bh/rtset?do=add&pid=556010&ev=a77dcf3e-0a02-43b0-ba25-509c697b290e
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/55972/ Frame FFD8 0
120 B 75ms
72ms Image
text/plain 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55972/sync?uid=74cJbKLYQW79&_origin=1&gdpr=0&gdpr_consent=

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

xuid
eb2.3lift.com/ Frame FFD8
Redirect Chain

https://eb2.3lift.com/xuid?mid=2636&xuid=74cJbKLYQW79&dongle=8bee
https://eb2.3lift.com/xuid?ld=1&mid=2636&xuid=74cJbKLYQW79&dongle=8bee&gdpr=0&cmp_cs=&us_privacy=

37 B
354 B

105ms
99ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2636&xuid=74cJbKLYQW79&dongle=8bee&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2636&xuid=74cJbKLYQW79&dongle=8bee&gdpr=0&cmp_cs=&us_privacy=
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 v1
match.sharethrough.com/sync/ Frame FFD8 68 B
280 B 360ms
104ms Image
image/png 3.214.6.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&source_user_id=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.6.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-6-158.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame FFD8
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pp
https://match.prod.bidr.io/cookie-sync/pp?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFHV0ZVN0tXcG9BQUJ2ZWUxd1hxdw&bee_sync_partners=pm%2Csas%2Csyn%2Cpp&bee_sync_current_partner=adx&bee_sync_initiator=pp&...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Csyn%2Cpp&bee_sync_current_partner=adx&bee_sync_initiator=pp&bee_sync_hop_count=1
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAJZ7E7KWpoAABxo6KAAXg&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Csyn%2Cpp&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
https://rtb-csync.smartadserver.com/redir?partneruserid=AAJZ7E7KWpoAABxo6KAAXg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsyn%252Cpp%26bee_sync_curr...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=syn%2Cpp&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=6098153373786994889
https://sync.technoratimedia.com/services?uid=AAJZ7E7KWpoAABxo6KAAXg&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D6098153373786994889%26bee_sync_partners%3Dpp%26bee_sy...
https://contextual.media.net/cksync.php?cs=3&type=syn&ovsid=25798003961C4C21860E6593C1D9BD74&redir=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26nuid%3D25798003961C4C21860E6593C1D9...
https://sync.technoratimedia.com/services?srv=cs&nuid=25798003961C4C21860E6593C1D9BD74&att=1&pid=62&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D6098153373786994889%26bee_sync_partn...
https://match.prod.bidr.io/cookie-sync?userid=6098153373786994889&bee_sync_partners=pp&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4
https://bh.contextweb.com/bh/rtset?ev=AAJZ7E7KWpoAABxo6KAAXg&do=add&pid=558502

49 B
1 KB

62ms
61ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?ev=AAJZ7E7KWpoAABxo6KAAXg&do=add&pid=558502

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1

Redirect headers

location: https://bh.contextweb.com/bh/rtset?ev=AAJZ7E7KWpoAABxo6KAAXg&do=add&pid=558502
Date: Mon, 16 Oct 2023 14:48:14 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

/
sync.taboola.com/sg/smaatortb-network/1/rtb-h/ Frame FFD8
Redirect Chain

https://s.ad.smaato.net/c/?dspInit=1001299&dspCookie=74cJbKLYQW79
https://cm.g.doubleclick.net/pixel?google_nid=smaato&gdpr=0&gdpr_consent=&google_hm=562a428ca9&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg%26gdpr%3D0%26gdpr_consent%3D
https://s.ad.smaato.net/c/?adExInit=g&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://b1sync.zemanta.com/usersync/smaato/?cb=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FdspId%3D1001748%26dspCookie%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D,&gdpr=0&gdpr_consent=,
https://s.ad.smaato.net/c/?dspId=1001748&dspCookie=&gdpr=0&gdpr_consent=,&gdpr=0&gdpr_consent=,
https://sync.taboola.com/sg/smaatortb-network/1/rtb-h/?taboola_hm=562a428ca9&gdpr=0&gdpr_consent=,,,

0
374 B

565ms
87ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/smaatortb-network/1/rtb-h/?taboola_hm=562a428ca9&gdpr=0&gdpr_consent=,,,
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 23955

Redirect headers

date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 dbb909966903df95f63a00d4241f7b7c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: IAD89-P2
x-cache: Miss from cloudfront
location: https://sync.taboola.com/sg/smaatortb-network/1/rtb-h/?taboola_hm=562a428ca9&gdpr=0&gdpr_consent=,,,
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: ATO11jz4IetjP9K4MVRnZlGANZnfqRDHUZNMsOh7pQ7iLMIPAGUwVA==

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame FFD8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_cm&google_hm=74cJbKLYQW79
https://bh.contextweb.com/bh/rtset?pid=559960&ev=1&google_gid=CAESEBNt3oTXXiUvJUY-jcHlVYs&google_cver=1

49 B
990 B

85ms
84ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?pid=559960&ev=1&google_gid=CAESEBNt3oTXXiUvJUY-jcHlVYs&google_cver=1

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?pid=559960&ev=1&google_gid=CAESEBNt3oTXXiUvJUY-jcHlVYs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 312
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
trc.taboola.com/sg/rtb-pulsepoint-network/1/rtb-h/ Frame FFD8 0
460 B 234ms
75ms Image
text/plain 2a04:4e42:600::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/rtb-pulsepoint-network/1/rtb-h/?taboola_hm=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-vcl-time-ms: 17
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 varnish
x-served-by: cache-yyz4528-YYZ
server: nginx
x-timer: S1697467693.056707,VS0,VE17
x-fastly-to-nlb-rtt: 13897
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-service-version: v1
x-cache-hits: 0

GET
H2 200 sync
partners.tremorhub.com/ Frame FFD8 43 B
175 B 347ms
92ms Image
image/gif 2600:1f18:612b:4264:936e:bcf9:b85:4d88
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?uipp=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:936e:bcf9:b85:4d88 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx
content-type: image/gif

GET
H2 200 UserMatch.ashx
atemda.com/ Frame FFD8 43 B
1 KB 232ms
70ms Image
image/gif 35.190.113.31
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atemda.com/UserMatch.ashx?bidderid=97&bidderuid=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.113.31 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 31.113.190.35.bc.googleusercontent.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
via: 1.1 google
access-control-allow-methods: GET
p3p: CP="NOI DSP NID BUS UNI COM NAV INT STA OTC CURa ADMa DEVa PSAa PSDa OUR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 16 Oct 2023 14:48:12 GMT

GET
H2 200 um
sync.teads.tv/ Frame FFD8 23 B
278 B 329ms
121ms Image
image/gif 96.16.25.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=142&uid=74cJbKLYQW79&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.16.25.160 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-25-160.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Mon, 16 Oct 2023 14:48:13 GMT
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame FFD8 43 B
479 B 75ms
72ms Image
image/gif 52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=74cJbKLYQW79&ex=Pulsepoint

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: MDB3JA4VNXHSXQGMVCZW
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sync
ads.yieldmo.com/v000/ Frame FFD8 43 B
596 B 367ms
112ms Image
image/gif 18.234.17.151
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?userid=74cJbKLYQW79&ext=1&pn_id=pp
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.234.17.151 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-234-17-151.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

GET
H2 200 usersync
sync.springserve.com/ Frame FFD8 43 B
206 B 386ms
118ms Image
image/gif 107.20.22.234
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.springserve.com/usersync?aid=849&uuid=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.22.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-20-22-234.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Oct 2023 14:48:13 GMT
access-control-allow-credentials: true
server: nginx
content-length: 43
access-control-allow-methods: GET, OPTIONS
content-type: image/gif

GET
H2 200 rum
dsum.casalemedia.com/ Frame FFD8 43 B
358 B 74ms
71ms Image
image/gif 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=189&external_user_id=74cJbKLYQW79&expiration=[EXPIRATION]
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GdXGhDuWQjOhqjC1vh59R4EtCvRLCWaJxYA5hjwURseFeWvSxNHyBzGxpKEaUcGRik3n%2BgMI4%2BQfBqzF3yyw3GlmDW4jALJk7yIW%2Bd0nQFVmBfN8XsSsmiRb7vV5pfXozwPTZkJ%2F"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 817119fab9d23739-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

GET
H/1.1 404
Not Found pp.gif
sync.colossusssp.com/ Frame FFD8 9 B
175 B 379ms
130ms Image
text/plain 172.240.155.84
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.colossusssp.com/pp.gif?puid=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.240.155.84 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/plain

GET
H2 204 /
trc.taboola.com/sg/pulsepointrtb-network/1/rtb-h/ Frame FFD8 0
65 B 67ms
67ms Image
text/plain 2a04:4e42:600::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 varnish
x-served-by: cache-yyz4528-YYZ
server: nginx
x-timer: S1697467693.242851,VS0,VE15
x-fastly-to-nlb-rtt: 14319
x-cache: MISS
accept-ranges: bytes
x-service-version: v1
x-cache-hits: 0

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame FFD8
Redirect Chain

https://i.liadm.com/s/55660?bidder_id=98251&bidder_uuid=74cJbKLYQW79
https://i.liadm.com/s/55660?bidder_id=98251&bidder_uuid=74cJbKLYQW79&_li_chk=true&previous_uuid=ce1b2a228bbd44cb814b35d9e2501a02
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=ce1b2a22-8bbd-44cb-814b-35d9e2501a02
https://p.rfihub.com/cm?pub=39342&in=1&userid=fedb1fd8-e050-4fc0-99b7-8d5eeba3c289%3A1697467694.0670989&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dfedb1fd8-e050-4fc0-99b7-8d5eeba...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=968625792217438120&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3Dfedb1fd8-e050-4fc0-99b...
https://idsync.rlcdn.com/501709.gif?partner_uid=fedb1fd8-e050-4fc0-99b7-8d5eeba3c289%3A1697467694.0670989&_=1697467694.0709202
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEGQ4kak383ZOy-exQA1Tgxc&google_cver=1

42 B
60 B

69ms
68ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEGQ4kak383ZOy-exQA1Tgxc&google_cver=1
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEGQ4kak383ZOy-exQA1Tgxc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

o
usync.vrtcal.com/ Frame FFD8
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=400&user_id=74cJbKLYQW79&expires=30&user_group=[NUMERICAL_VALUE]
https://usync.vrtcal.com/o?xs=1601&did=9e2535fe-6096-4ecc-b301-97bb812df648

35 B
257 B

623ms
257ms

Image
image/gif

54.215.164.241
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usync.vrtcal.com/o?xs=1601&did=9e2535fe-6096-4ecc-b301-97bb812df648
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Server: 54.215.164.241 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-215-164-241.us-west-1.compute.amazonaws.com
Software: Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.26
Resource Hash: 6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache/2.4.7 (Ubuntu)
x-powered-by: PHP/5.5.9-1ubuntu4.26
content-length: 35
content-type: image/gif

Redirect headers

Location: //usync.vrtcal.com/o?xs=1601&did=9e2535fe-6096-4ecc-b301-97bb812df648
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET bid
cs.chocolateplatform.com/ Frame FFD8 0
0

GET
H2 200 setuid
ib.adnxs.com/ Frame FFD8 43 B
824 B 95ms
94ms Image
image/gif 68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=494&code=74cJbKLYQW79

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
an-x-request-uuid: 855d577a-b702-47c2-bcb8-f64b137ca341
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sd
us-u.openx.net/w/1.0/ Frame FFD8 43 B
106 B 51ms
50ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=545637763&val=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame FFD8 42 B
192 B 96ms
95ms Image
image/gif 162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTkmdGw9MTI5NjAw&piggybackCookie=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 cksync.php
hbx.media.net/ Frame FFD8 53 B
473 B 94ms
93ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hbx.media.net/cksync.php?cs=3&type=ppt&ovsid=74cJbKLYQW79&redirect=http://adnetwork.com/redirect/link

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

GET
H2 200 cookiesyncendpoint
sync.aniview.com/ Frame FFD8 0
247 B 361ms
151ms Image
text/plain 96.46.186.182
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.aniview.com/cookiesyncendpoint?auid=4939fd63-7a0f-46b9-9b09-9b6faa8292c9&biddername=10&pid=59c9148628a0612da3689288&key=74cJbKLYQW79
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?reat=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.182 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-length: 0

GET

sync
ads.servenobid.com/ Frame FFD8
Redirect Chain

https://ads.servenobid.com/getsync?ver=1&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D563074%26ev%3D%24UID
https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253Fjp%253D1%2526redirect%253Dhttps%25...
https://ads.servenobid.com/sync?pid=312&uid=4396685237194775250&redirect=https%3A%2F%2Fads.servenobid.com%2Fgetsync%3Fjp%3D1%26redirect%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset%253F...
https://ads.servenobid.com/getsync?jp=1&redirect=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D563074%26ev%3D%24UID
https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3220388398
https://sync.1rx.io/usersync/tradedesk/f10fca9b-fb3f-404c-b66c-35ce97d5eea1
https://sync.targeting.unrulymedia.com/csync/RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-00...
https://ads.servenobid.com/sync?pid=321&uid=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005&redirect=https%3A%2F%2Fads.servenobid.com%2Fgetsync%3Fjp%3D2%26redirect%3Dhttps%253A%252F%252Fbh.contextweb.c...
https://ads.servenobid.com/getsync?jp=2&redirect=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D563074%26ev%3D%24UID
https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1YN-&redirectUri=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%5Bssb_sync_pid%5D%26redire...
https://ads.servenobid.com/sync?pid=317&uid=6098153373786994889&redirect=https%3A%2F%2Fads.servenobid.com%2Fgetsync%3Fjp%3D3%26redirect%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset%253F...
https://ads.servenobid.com/getsync?jp=3&redirect=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D563074%26ev%3D%24UID
https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=0&gdpr_consent=&us_privacy=1YN-&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D353%26uid%3D%3Cvsid%...
https://ads.servenobid.com/sync?pid=353&uid=3404692936510273000V10&redirect=https%3A%2F%2Fads.servenobid.com%2Fgetsync%3Fjp%3D4%26redirect%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset%2...
https://ads.servenobid.com/getsync?jp=4&redirect=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D563074%26ev%3D%24UID
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D%26redirect%3Dhttps%253A%25...
https://ads.servenobid.com/sync?pid=310&uid=Hfv4fLZHqH1XBF01QoauFBC6&redirect=https%3A%2F%2Fads.servenobid.com%2Fgetsync%3Fjp%3D5%26redirect%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset...
https://ads.servenobid.com/getsync?jp=5&redirect=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D563074%26ev%3D%24UID
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3D%23PMUID%26redirect%3Dhttps%253A%252F%252Fa...
https://ads.servenobid.com/sync?pid=316&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&redirect=https%3A%2F%2Fads.servenobid.com%2Fgetsync%3Fjp%3D6%26redirect%3Dhttps%253A%252F%252Fbh.contextweb.com%252F...

0
0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 6267 0
594 B 101ms
101ms Script
text/html 68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
an-x-request-uuid: 120c9e94-180f-4c3c-9d82-7260d74183d4
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame DEC8
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

2 KB
1 KB

108ms
107ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b44f620ad97fabcb5d75d25c833aace2b4fb449479fcb079cf962635fc95df80

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 817119f97fd03739-YYZ
content-encoding: br
content-type: text/html
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RzeuKfUJ9KtPSMeV1cbdPAPeovIaPUtGOik6U2ta2e%2BwMBDt23A9cuOGUgWmPOiG3D6tbhCkzoSxFb2txNFS2EImaVP%2BpV80rdVkr4u0D3Fr1t5JO2AVkwoKUAbn71NcGfqzq4US0wPkFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 817119f8ce9b3739-YYZ
content-length: 0
date: Mon, 16 Oct 2023 14:48:12 GMT
expires: 0
location: /usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CZIp6YTg9FRxx7dqcFjBri1p1z2FpkbFSQJcTyCtd3t4wVMk4B2eSIJ4aMky8zseztLV1Kfn2AHNGlEyqMLOBqn43jStltlEWtRKxMQcFARt5Cg7pOthebZhXtdJwYsRV08iePwRh6VEJw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 decode_consent.js Show response
static.smilewanted.com/js/decode_consent/ Frame 41C5 48 KB
12 KB 75ms
63ms Script
application/javascript 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.smilewanted.com/js/decode_consent/decode_consent.js

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://csync.smilewanted.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 286008
x-xss-protection: 1; mode=block
referrer-policy: strict-origin
last-modified: Thu, 15 Apr 2021 17:11:55 GMT
server: cloudflare
etag: W/"607873db-c1ce"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 817119f8ef6c36d8-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 creative__300x600_previous_gen_widget.css
widgets.outbrain.com/n2d/widget/100063/customCss/LEGACY/ Frame 8FF2 482 B
810 B 108ms
104ms Stylesheet
text/css 23.207.57.76
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/n2d/widget/100063/customCss/LEGACY/creative__300x600_previous_gen_widget.css
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/n2d/widget/widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.57.76 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-57-76.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a7d95017fa2379a4bf437aff9c95977004ffa0f3f4ab9544a685afa3120a0e6b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Mon, 16 Oct 2023 18:48:12 GMT
date: Mon, 16 Oct 2023 14:48:12 GMT
last-modified: Tue, 22 Aug 2023 10:30:49 GMT
server: AkamaiNetStorage
etag: "9d8b870db69e4f578fee693ff233fc33:1692700772.366871"
access-control-allow-methods: GET,POST
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 482
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ Frame 8FF2 990 B
1 KB 79ms
77ms Image
image/svg+xml 23.207.57.76
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.57.76 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-57-76.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Wed, 15 Nov 2023 14:48:12 GMT
date: Mon, 16 Oct 2023 14:48:12 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "5ab8e16b5f46213840bcd403e349419c:1673369393.880194"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 990
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H/1.1 200
OK /
b1t-chidc2.zemanta.com/t/imp/impression/4I7QK4HDIOEGFBLMXYHXXJYLTO5KLONGJN65GES5PV775DSYCBFQ4Q65GOF5RWICSFKMHZCAUJMQ67MK3ENQ5JTUN5LEUED3VOKCOED6T7M7JNI5OPLAYYG2FLCZYALK2AGIKU6CLKQOWBAIX56NNXVTSZ6HO... Frame 8FF2 26 B
127 B 314ms
56ms Image
image/gif 50.31.142.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1t-chidc2.zemanta.com/t/imp/impression/4I7QK4HDIOEGFBLMXYHXXJYLTO5KLONGJN65GES5PV775DSYCBFQ4Q65GOF5RWICSFKMHZCAUJMQ67MK3ENQ5JTUN5LEUED3VOKCOED6T7M7JNI5OPLAYYG2FLCZYALK2AGIKU6CLKQOWBAIX56NNXVTSZ6HOVWAHYFITV2WSIQBP7YSAZWRIPQ36X5CCE4XH6KQLJWQAW32HZ46RTCJOKZ7XQFVVIJAWRMILQDPXU4SRFN2HWB37Q73TAR3JWV4YNXUTZDTLT5LQURGMS64KQGMYCQMACWNNKDNNFMFP4GNKCAY4E2OH6J5MMYPQEOXXH3F5HD2EF2JB5ISYBNG5BCB6SJBGEBP6MWNVT37UGAOC6QO6JTQ/?
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.127 Hickory Hills, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Length: 26
Content-Type: image/gif

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3703 1 KB
643 B 61ms
60ms Document
text/html 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 73186
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 18:28:26 GMT
etag: 48472445140208031
expires: Mon, 16 Oct 2023 18:28:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 457.json Show response
id5-sync.com/g/v2/ 630 B
1 KB 362ms
362ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: finclan.com
URL: https://finclan.com/detroitchicago/tulsa.js?gcb=195-2&cb=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

56cdb5373ea4a83da2a764b8b1cc5e82d9143a8ae9508660f6d8e19adf6f8b23

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://finclan.com
date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 drop_cookie_sw.php Show response
csync.smilewanted.com/ Frame 3AE3 0
341 B 171ms
164ms Document
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/drop_cookie_sw.php
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 817119f9587836d8-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 7D4D 4 KB
2 KB 50ms
43ms Document
text/html 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

945f351b683b36e9853d0285f8a8e700873da1ef6607d104f92cc708c2526825

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1421
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 357ms
143ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 16 Oct 2023 14:48:12 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 370536
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3703
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESELFiSf165DNnfB6BFxDNtZk&google_cver=1&google_push=AXcoOmSczEncWcblzGJB6-jkFXMvM0rRsWvGkxzvPHd6jRaP3lg5CUE6cULFEJlXg6VpHfo8_XWeASwxIADGLKWbHom1...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmSczEncWcblzGJB6-jkFXMvM0rRsWvGkxzvPHd6jRaP3lg5CUE6cULFEJlXg6VpHfo8_XWeASwxIADGLKWbHom1Lol33rZV&google_hm=

170 B
188 B

225ms
225ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmSczEncWcblzGJB6-jkFXMvM0rRsWvGkxzvPHd6jRaP3lg5CUE6cULFEJlXg6VpHfo8_XWeASwxIADGLKWbHom1Lol33rZV&google_hm=

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmSczEncWcblzGJB6-jkFXMvM0rRsWvGkxzvPHd6jRaP3lg5CUE6cULFEJlXg6VpHfo8_XWeASwxIADGLKWbHom1Lol33rZV&google_hm=
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3703
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEEUqP_JzvSedBmMN2FwiDKc&c_param1=AXcoOmS2l8bJCZeM6uU4l876o0YyvB2IYZlLpvybMnjPpW39Yg6mR4rS2-rnv2YtTHl_2j9zx8IJaJwRq_-wJS3cB8qJwl9lud5o&gdpr=%%GDPR%%&...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmS2l8bJCZeM6uU4l876o0YyvB2IYZlLpvybMnjPpW39Yg6mR4rS2-rnv2YtTHl_2j9zx8IJaJwRq_-wJS3cB8qJwl9lud5o

170 B
188 B

182ms
181ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmS2l8bJCZeM6uU4l876o0YyvB2IYZlLpvybMnjPpW39Yg6mR4rS2-rnv2YtTHl_2j9zx8IJaJwRq_-wJS3cB8qJwl9lud5o

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmS2l8bJCZeM6uU4l876o0YyvB2IYZlLpvybMnjPpW39Yg6mR4rS2-rnv2YtTHl_2j9zx8IJaJwRq_-wJS3cB8qJwl9lud5o
date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx/1.23.2
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3703
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDTJV__7UBjqC9cr9irHNYY&google_cver=1&google_push=AXcoOmTD-58Ngj20NtJJgHFOPZDjcoe7gFow3jC9cAm5uYRAjD0oHx_0ulrf4wdlJtXSoQHijWpVjljU...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEDTJV__7UBjqC9cr9irHNYY&google_cver=1&google_push=AXcoOmTD-58Ngj20NtJJgHFOPZDjcoe7gFow3jC9cAm5uYRAjD0oHx_0ulrf4wdlJtXSoQHijWp...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzM3MTAwMzMyNDUxNTk5MjY3NQ&google_push=AXcoOmTD-58Ngj20NtJJgHFOPZDjcoe7gFow3jC9cAm5uYRAjD0oHx_0ulrf4wdlJtXSoQHijWpVjl...

170 B
188 B

93ms
91ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzM3MTAwMzMyNDUxNTk5MjY3NQ&google_push=AXcoOmTD-58Ngj20NtJJgHFOPZDjcoe7gFow3jC9cAm5uYRAjD0oHx_0ulrf4wdlJtXSoQHijWpVjljUlxj8LjsxFs5VQM_53WVs

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzM3MTAwMzMyNDUxNTk5MjY3NQ&google_push=AXcoOmTD-58Ngj20NtJJgHFOPZDjcoe7gFow3jC9cAm5uYRAjD0oHx_0ulrf4wdlJtXSoQHijWpVjljUlxj8LjsxFs5VQM_53WVs
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET pub
cs.chocolateplatform.com/ Frame 3703 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3703
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESECKjo2DU6pf2BEGC2hAWedk&google_cver=1&google_push=AXcoOmSdu8Xk4tmAtkj06L3yQPgB__2WRYFKwut6NNnR2yiMpN0t0yHmDEOm8U4qLYpJhO6_QEZ0kvRq73kqAqJ2fHpLdEAgJDnx
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmSdu8Xk4tmAtkj06L3yQPgB__2WRYFKwut6NNnR2yiMpN0t0yHmDEOm8U4qLYpJhO6_QEZ0kvRq73kqAqJ2fHpLdEAgJDnx&google_hm=90bfa6811c8ce48d629...

170 B
188 B

116ms
115ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmSdu8Xk4tmAtkj06L3yQPgB__2WRYFKwut6NNnR2yiMpN0t0yHmDEOm8U4qLYpJhO6_QEZ0kvRq73kqAqJ2fHpLdEAgJDnx&google_hm=90bfa6811c8ce48d629dd59940ce0735

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmSdu8Xk4tmAtkj06L3yQPgB__2WRYFKwut6NNnR2yiMpN0t0yHmDEOm8U4qLYpJhO6_QEZ0kvRq73kqAqJ2fHpLdEAgJDnx&google_hm=90bfa6811c8ce48d629dd59940ce0735
date: Mon, 16 Oct 2023 14:48:13 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H2

200

/
onetag-sys.com/match/ Frame 3703
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1&google_push=AXcoOmRPJ7QkyYcEqzy30hlzV0eMXInj3NAhifNGtcNWuQGZfjO1QAfAmcUBa-i5AQfnIyqkP2Ysz7Si1-8...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1d-yOyntDgiGGdO8t7QVwKOJ3jX532g&google_push=AXcoOmRPJ7QkyYcEqzy30hlzV0eMXInj3NAhifNGtcNWuQGZfjO1QAfAmcUBa-i5AQfnIyqkP2Ysz7Si1-...
https://onetag-sys.com/match/?int_id=19&google_error=5

0
291 B

105ms
98ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3703
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEO_x-7KcxfKlQfifSgrVgrQ&google_cver=1&google_push=AXcoOmRA2Ws2HDuaijwvG3KWnFuw_oQCET3jOqrPuYvc9oiwBWUCzDivTfLEVXIKwei...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRA2Ws2HDuaijwvG3KWnFuw_oQCET3jOqrPuYvc9oiwBWUCzDivTfLEVXIKweijSjk6C14Hv2zguXi9_Ks9wz57o0pRxjyI0A

170 B
188 B

109ms
108ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRA2Ws2HDuaijwvG3KWnFuw_oQCET3jOqrPuYvc9oiwBWUCzDivTfLEVXIKweijSjk6C14Hv2zguXi9_Ks9wz57o0pRxjyI0A

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id: 72efbd53
date: Mon, 16 Oct 2023 14:48:13 GMT
x-bytefaas-request-id: 20231016144813034076299BB43C6B1708
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-209-100-91.deploy.akamaitechnologies.com (AkamaiGHost/11.3.0-51620215) (-)
server-timing: inner; dur=18, cdn-cache; desc=MISS, edge; dur=1, origin; dur=21
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20231016144813034076299BB43C6B1708
access-control-max-age: 86400
access-control-allow-methods: *
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRA2Ws2HDuaijwvG3KWnFuw_oQCET3jOqrPuYvc9oiwBWUCzDivTfLEVXIKweijSjk6C14Hv2zguXi9_Ks9wz57o0pRxjyI0A
x-bytefaas-execution-duration: 17.26
access-control-allow-origin: *
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 011e2671fed6c5c1cdc19e33ee0a84a734de3cc1107dd2d1a1bf53ecbbfe5c21f48052b474ee96b9468ee6cf85b89e60d04862e945ec6d3412b02d1aaafa272d8ce6fe14d79c55687e4223d4f702578370465104a457dc9b010b50ca48bc06ed63
x-origin-response-time: 21,23.209.100.91
cache-control: max-age=0, no-cache, no-store
access-control-allow-headers: *
expires: Mon, 16 Oct 2023 14:48:13 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3703 0
12 B 72ms
71ms Image
text/html 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LU5-GK8tZaz719tY0ijSUnbIvjAkS0zN0pfuNtH0zMxkFPhDd7zUd78WvTz3O0eP0D9RL7V0s

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3F03 38 KB
11 KB 183ms
183ms Script
text/html 104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c32e49d778bd9d7756254a90139f62469a8a2a7f6e29be2144f804eb41fdf801

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 20:54:07 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=21822
Connection: keep-alive
Content-Length: 10838
Expires: Mon, 16 Oct 2023 20:51:55 GMT

GET
H2

200

Hfv4fLZHUsIEuZPVQ1C2SLn1 Show response
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 63D5
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID&sovrn_retry=true
https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hfv4fLZHUsIEuZPVQ1C2SLn1

0
455 B

170ms
169ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hfv4fLZHUsIEuZPVQ1C2SLn1
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 817119fc7e7936d8-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Mon, 16 Oct 2023 14:48:13 GMT
Location: https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hfv4fLZHUsIEuZPVQ1C2SLn1
X-Sovrn-Pod: ad_ap7ewr1

GET
H2

200

/
onetag-sys.com/match/ Frame 7D4D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=e1a4652d-4d2c-4700-82f4-9ec27c2cfa0a&gdpr=1&gdpr_consent=

0
291 B

60ms
57ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=e1a4652d-4d2c-4700-82f4-9ec27c2cfa0a&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: MT3 1075 283b7e3 master ord ord-pixel-x14 config_version:"1969"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=e1a4652d-4d2c-4700-82f4-9ec27c2cfa0a&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 16 Oct 2023 14:48:12 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 7D4D 0
239 B 447ms
143ms Image
image/gif 213.19.162.80
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 213.19.162.80 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: deb9f124eecce7a554c70ca983265c95
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 7D4D
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=4396685237194775250

0
291 B

103ms
97ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=4396685237194775250

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
an-x-request-uuid: d98ac6b0-6eca-4ff3-b6b0-c5b5d898b9c2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=4396685237194775250
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 7D4D
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=3&uid=171b56b8ab509c422f85cb41e328e184&gdpr_consent=&gdpr=1

0
291 B

101ms
97ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=3&uid=171b56b8ab509c422f85cb41e328e184&gdpr_consent=&gdpr=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=3&uid=171b56b8ab509c422f85cb41e328e184&gdpr_consent=&gdpr=1
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1697467693105082-179

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 7D4D 42 B
703 B 68ms
65ms Image
image/gif 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=yUM4vts1AChrR55JQ7SMmNiLHYkiuj2K8gC2lQym-Po
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7D4D
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1eBeyCW8jJj-2E2DSAWVWpibtIQNTIw

170 B
188 B

145ms
141ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1eBeyCW8jJj-2E2DSAWVWpibtIQNTIw

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1eBeyCW8jJj-2E2DSAWVWpibtIQNTIw
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ Frame 7D4D 0
44 B 77ms
73ms Image
text/plain 216.22.16.53
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 216.22.16.53 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 7D4D
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=c91RPUBZWARAXY_xiMpPKf6X1tyD4mJeE5tqOt7V2vU

43 B
479 B

267ms
85ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=c91RPUBZWARAXY_xiMpPKf6X1tyD4mJeE5tqOt7V2vU

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WJ5V0CY7Y8JMFGBFP3XZ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=c91RPUBZWARAXY_xiMpPKf6X1tyD4mJeE5tqOt7V2vU
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 7D4D 0
39 B 65ms
61ms Image
text/plain 8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:11 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 7D4D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

0
291 B

69ms
68ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame 7D4D 0
38 B 60ms
57ms Image
text/plain 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 7D4D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=

0
291 B

61ms
58ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=29&uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Kestrel
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 7D4D 43 B
235 B 244ms
74ms Image
image/gif 35.211.178.172
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 yUM4vts1AChrR55JQ7SMmNiLHYkiuj2K8gC2lQym-Po&gdpr=1&gdpr_consent=&us_privacy=
csync.smilewanted.com/set_partner_userid_get/onetag/ Frame 7D4D 0
403 B 173ms
170ms Image
text/html 172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://csync.smilewanted.com/set_partner_userid_get/onetag/yUM4vts1AChrR55JQ7SMmNiLHYkiuj2K8gC2lQym-Po&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7f5d22b0006ab5a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-credentials: true
cf-ray: 817119f9b92b36d8-YYZ
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2 200 pubcid.php Show response
hbx.media.net/ Frame 71B7 57 KB
18 KB 376ms
87ms Script
text/html 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hbx.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
content-encoding: gzip
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: max-age=1800
content-length: 18543
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 15:18:13 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 71B7 88 B
328 B 69ms
67ms Script
text/javascript 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=1---&j=window.advBidxc.mnetRtusId

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d1db52d18fb924ebf8f9e09d072d189535fdd7afbe9f46b7d1071d517f799bb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1986098
expires: 60

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame F7AB
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
https://eus.rubiconproject.com/usync.html?p=medianet

281 B
554 B

276ms
84ms

Document
text/html

104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=medianet
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 16 Oct 2023 14:48:13 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=medianet
server: AkamaiGHost

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame F947
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Drkt%26refUrl%3D%26vid%3D746769310334046929365102730...
https://contextual.media.net/cksync.html?cs=8&vsid=3404692936510273000V10&type=rkt&refUrl=&vid=74676931033404692936510273000V10&ovsid=970033168448234153

227 B
650 B

174ms
173ms

Document
text/html

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3404692936510273000V10&type=rkt&refUrl=&vid=74676931033404692936510273000V10&ovsid=970033168448234153

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

f40a964762f9dda40267c948eb46f52a0932a9629b57abb0801841af15e0bb35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 227
content-type: text/html;charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: Mon, 16 Oct 2023 14:48:13 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Mon, 16 Oct 2023 14:48:13 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3404692936510273000V10&type=rkt&refUrl=&vid=74676931033404692936510273000V10&ovsid=970033168448234153
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4B0A 15 KB
6 KB 101ms
91ms Document
text/html 69.192.109.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676931033404692936510273000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.109.53 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-109-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=121581
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: Wed, 18 Oct 2023 00:34:34 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cksync.php
contextual.media.net/ Frame 71B7
Redirect Chain

https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%...
https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=76f0e174bd6913fe&is_secure=true&version=1&networkId=57734&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.ph...
https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=con&refUrl=&vid=74676931033404692936510273000V10&ovsid=AAAGhRc4UkSlsgMKsbYsAAAAAAA&expiration=1697554093&is_secure=true...

53 B
459 B

208ms
208ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=con&refUrl=&vid=74676931033404692936510273000V10&ovsid=AAAGhRc4UkSlsgMKsbYsAAAAAAA&expiration=1697554093&is_secure=true&gdpr_consent=&gdpr=0

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=con&refUrl=&vid=74676931033404692936510273000V10&ovsid=AAAGhRc4UkSlsgMKsbYsAAAAAAA&expiration=1697554093&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

cksync.html
contextual.media.net/ Frame 71B7
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3404692936510273...
https://contextual.media.net/cksync.html?cs=8&vsid=3404692936510273000V10&type=opx&refUrl=&vid=74676931033404692936510273000V10&ovsid=50d25049-e36a-41ff-9a88-d9a71108cb8d

227 B
227 B

183ms
180ms

Image
text/html

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3404692936510273000V10&type=opx&refUrl=&vid=74676931033404692936510273000V10&ovsid=50d25049-e36a-41ff-9a88-d9a71108cb8d

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
vary: Accept-Encoding
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: text/html;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 227
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://contextual.media.net/cksync.html?cs=8&vsid=3404692936510273000V10&type=opx&refUrl=&vid=74676931033404692936510273000V10&ovsid=50d25049-e36a-41ff-9a88-d9a71108cb8d
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 71B7
Redirect Chain

https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Dr1%26refUrl%3D%26vid%3D74676931033404692936...
https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&zcc=1&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Dr1%26refUrl%3D%26vid%3D74676931033404...
https://ad.turn.com/r/cs?pid=45&rndcb=3312453082
https://sync.1rx.io/usersync/turn/3408878892399404145?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005?redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Dr1%2...
https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=r1&refUrl=&vid=74676931033404692936510273000V10&ovsid=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005

53 B
470 B

515ms
515ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=r1&refUrl=&vid=74676931033404692936510273000V10&ovsid=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:14 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:14 GMT

Redirect headers

Date: Mon, 16 Oct 2023 14:48:14 GMT
Server: Tengine
ETag: RX75fe741e953d486fa5b7d27d0cdd23e9005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=r1&refUrl=&vid=74676931033404692936510273000V10&ovsid=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005
Content-Type: text/html
Connection: keep-alive

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 71B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzQwNDY5MjkzNjUxMDI3MzAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEDFIk4yJ4cjMQ0SkTW1dRNQ&google_cver=1

53 B
618 B

356ms
128ms

Image
image/gif

23.195.76.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEDFIk4yJ4cjMQ0SkTW1dRNQ&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Server: 23.195.76.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-76-23.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 53
x-mnet-hl2: E
Expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEDFIk4yJ4cjMQ0SkTW1dRNQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 71B7
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Ddxu%26refUrl%3D%26vid%3D74676931033404692936510...
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Ddxu%26refUrl%3D%26vid%3D74676931033404692...
https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=dxu&refUrl=&vid=74676931033404692936510273000V10&ovsid=8g8OWeMy1QSoTb5

53 B
450 B

249ms
249ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=dxu&refUrl=&vid=74676931033404692936510273000V10&ovsid=8g8OWeMy1QSoTb5

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-790-g2a3fdc2#rel-ec2-master i-05a965c5171e426ea@us-east-1b@dxedge-app-us-east-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=dxu&refUrl=&vid=74676931033404692936510273000V10&ovsid=8g8OWeMy1QSoTb5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 71B7
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsi...
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=eabc157f-0b14-4b7f-9433-f7769bfc864d&gdpr=0&gdpr_consent=&us_privacy=

53 B
616 B

404ms
403ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=eabc157f-0b14-4b7f-9433-f7769bfc864d&gdpr=0&gdpr_consent=&us_privacy=

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=eabc157f-0b14-4b7f-9433-f7769bfc864d&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2131550
content-length: 0
expires: Mon, 16 Oct 2023 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 71B7
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://x.bidswitch.net/ul_cb/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=medianet&ssp_user_id=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-HAaXhMNE2plNTDn7zUOLOVro1Si6Ehijrq_cnA--~A&expires=5&ssp=medianet
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=

53 B
463 B

205ms
204ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 71B7
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?puid=${VSID}&cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__
https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__&puid=%24%7BVSID%7D&s=2
https://contextual.media.net/cksync.php?cs=1&type=zem&ovsid=36-p_gvW8yD_4CzBIbkQ

53 B
455 B

278ms
276ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=zem&ovsid=36-p_gvW8yD_4CzBIbkQ

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=1&type=zem&ovsid=36-p_gvW8yD_4CzBIbkQ
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 111
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 71B7
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=3404692936510273000V10
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=medianet&ssp_user_id=3404692936510273000V10
https://contextual.media.net/cksync.php?type=mf&ovsid=016cc285-36b9-4426-8a09-4d79e3b52ba6&cs=1

53 B
464 B

166ms
166ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=mf&ovsid=016cc285-36b9-4426-8a09-4d79e3b52ba6&cs=1

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

location: //contextual.media.net/cksync.php?type=mf&ovsid=016cc285-36b9-4426-8a09-4d79e3b52ba6&cs=1
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 710489.gif
id.rlcdn.com/ Frame 71B7 42 B
298 B 73ms
66ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/710489.gif
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 71B7
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1

53 B
629 B

351ms
136ms

Image
image/gif

23.195.76.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Server: 23.195.76.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-76-23.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 53
x-mnet-hl2: E
Expires: Mon, 16 Oct 2023 14:48:13 GMT

Redirect headers

location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Kestrel
content-length: 199

GET
H2 200 idl.js Show response
assets.a-mo.net/js/ Frame 5471 2 KB
1 KB 50ms
49ms Script
text/javascript 2606:4700::6813:9e13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=finclan.com&e=27&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9e13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2239a36b676f56ac4569b253bebe7fd244c22f91c76cee060640386cb16020d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 9f302ccf52b583f5eb46c01abcc2772e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: YUL62-C1
age: 67
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 27 Jun 2023 16:12:52 GMT
server: cloudflare
etag: W/"a61ed4db59070cd66af981cbd85859ca"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 817119fa28baa223-YYZ
x-amz-cf-id: 3lkkdhssNcmbyPGrUoWKu6_D61ZldprMW2OT52jaUk1HS-TYLGFqww==
expires: Mon, 16 Oct 2023 15:48:13 GMT

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 5471 43 B
235 B 185ms
69ms Image
image/gif 35.211.178.172
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=adaptmx&user_id=5374e504-a5ec-4295-b070-9e951eaa6f7b&gdpr=0&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame 5471
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b
https://prebid.a-mo.net/setuid/yahoo?uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A&gdpr=0

0
114 B

82ms
81ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A&gdpr=0
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A&gdpr=0
date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 5471
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=1---
https://prebid.a-mo.net/setuid/magnite?uid=LNT0FNR4-24-IKB9&gdpr=0&us_privacy=1---

0
115 B

74ms
69ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LNT0FNR4-24-IKB9&gdpr=0&us_privacy=1---
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LNT0FNR4-24-IKB9&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame 5471
Redirect Chain

https://id.a-mx.net/u?&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Damx_com%26uid%3D
https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=amx_com&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b

0
113 B

59ms
55ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=amx_com&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=amx_com&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b
date: Mon, 16 Oct 2023 14:48:12 GMT
content-length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame 5471
Redirect Chain

https://rtb.openx.net/sync/prebid?&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Dopenx%26uid%3D%24%7BUID%7D
https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=openx&uid=a120b619-f1f5-48f6-924b-67dc22bc9bdc

0
125 B

57ms
57ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=openx&uid=a120b619-f1f5-48f6-924b-67dc22bc9bdc
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=openx&uid=a120b619-f1f5-48f6-924b-67dc22bc9bdc
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 154

GET
H2 200 cookie
cm.adform.net/ Frame 5471 43 B
106 B 225ms
218ms Image
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?&gdpr=0&gdpr_consent=&us_privacy=1---&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Dadform%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2

204

setuid
prebid.a-mo.net/ Frame 5471
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bid...
https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=smartadserver&uid=6098153373786994889

0
114 B

73ms
72ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=smartadserver&uid=6098153373786994889
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 0
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=smartadserver&uid=6098153373786994889
date: Mon, 16 Oct 2023 14:48:12 GMT
content-length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame 5471
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Dpubmatic%26uid%3DCDEE0271-7872-47B1-8...
https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=pubmatic&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

0
112 B

62ms
61ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=pubmatic&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=pubmatic&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

setuid
prebid.a-mo.net/ Frame 5471
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Dindex_rtb%2...
https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=index_rtb&uid=ZS1NLM4NBN0.v9ejan-EtAAA%263485

0
112 B

70ms
68ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=index_rtb&uid=ZS1NLM4NBN0.v9ejan-EtAAA%263485
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iIC4ngFfJKuM2qHecaxSzGrp34LiV40oz%2F7WOB0U47O%2BH8iS7z2mWuqQg0ktBsXTjjoNtfsDHROgFrgx7NZM8%2BWwI%2Fg27B7xHgtPGMC3OecHY%2FKRV7wE2mUHALpX%2B8N43tkDKa2X"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=index_rtb&uid=ZS1NLM4NBN0.v9ejan-EtAAA%263485
cache-control: no-cache
cf-ray: 817119fa38e03739-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame 5471
Redirect Chain

https://ap.lijit.com/pixel?&gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Dsovrn%26uid%3D%24UID
https://ap.lijit.com/pixel?&gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=...
https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=sovrn&uid=Hfv4fLZHqH1XBF01QoauFBC6

0
112 B

104ms
103ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=sovrn&uid=Hfv4fLZHqH1XBF01QoauFBC6
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=sovrn&uid=Hfv4fLZHqH1XBF01QoauFBC6
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame 5471
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D5374e504-a5ec-4295-b070-9e951eaa6f7b%26bidder%3Dappnexus%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=appnexus&uid=4396685237194775250

0
135 B

72ms
68ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=appnexus&uid=4396685237194775250
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
an-x-request-uuid: ff6f55f6-5beb-42b4-b583-3ee3b82dbe81
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://prebid.a-mo.net/setuid?A=5374e504-a5ec-4295-b070-9e951eaa6f7b&bidder=appnexus&uid=4396685237194775250
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame 5471 43 B
1 KB 99ms
94ms Image
image/gif 68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b&do=finclan.com

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
an-x-request-uuid: 885adc83-3460-41b8-a1e6-ed93c4280af1
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ow.pubmatic.com/ Frame 5471 86 B
344 B 382ms
126ms Image
image/png 104.36.115.123
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=amx&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b&do=finclan.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.123 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-length: 86
content-type: image/png

GET
H/1.1 200
OK setuid
prebid-server.rubiconproject.com/ Frame 5471 86 B
707 B 684ms
177ms Image
image/png 69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=amx&uid=5374e504-a5ec-4295-b070-9e951eaa6f7b&do=finclan.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/png
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-encoding: gzip
transfer-encoding: chunked
Expires: 0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame DEC8 43 B
855 B 217ms
85ms Image
image/gif 52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZS1NLM4NBN0-v9ejan_EtAAADZ0AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: AF0VX3SVSK0T14C80SX4
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame DEC8
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&expiration=1700059693&gdpr=0&gdpr_consent=

43 B
444 B

137ms
136ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&expiration=1700059693&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B09E1avTlve5dScunNXONt5BNbin711TrwVY%2B%2FuxeUQFhK8M%2FvkX%2FPXfS4CG0cu%2Fb43bL8XqjL3MWy8xEoa%2BABuWWMJMDS7hxx6QQ17m9z7gd%2B6ljkHWffT1OCVcFu9nJx5K5o5nAMoLeg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 817119faea1a3739-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&expiration=1700059693&gdpr=0&gdpr_consent=
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Kestrel
content-length: 323

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame DEC8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZS1NLM4NBN0-v9ejan_EtAAADZ0AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEMBZXfysE79tuRRpWXziVnk&google_cver=1

43 B
735 B

220ms
219ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEMBZXfysE79tuRRpWXziVnk&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IP9jf%2FPoZjPsxYGTO6JOaMd8UKMAPGQRn%2Fv7K86kx%2F77%2FgOugGcoLxKG9ZIgldF2s7tXOXJbkTTlzfIMiD0Ra2sempcx0rj%2BaaZEeLbz99EFRV4eT1OWuqKQAgIkst6td54lFv13kPTv9g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 817119fb3b06a22e-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEMBZXfysE79tuRRpWXziVnk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame DEC8
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZS1NLM4NBN0.v9ejan-EtAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&google_hm=2

43 B
737 B

76ms
73ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LddREwVhMxj%2Fw8%2F3LW%2FrnJdorahgg6IF8w%2BE5UoXebOdcmDVm3cZgFg8g6xSgdAr%2FaZtkaw6cASLz8UYzF1cmdjLcv6APnvwuyAv%2FohbKDyuJCO1Mdp8YdABYx0AEKbqE3rtJkKhHSWMFA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 817119fc9cdca22e-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame DEC8
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=e27dd79f-6ef2-4ea9-9fc0-f1b402e43a23&expiration=1729090093

43 B
741 B

78ms
77ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=e27dd79f-6ef2-4ea9-9fc0-f1b402e43a23&expiration=1729090093
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EIl%2BNXwpgSg8ltE%2FK2lfYaTzFNd37uE5oNCOq%2F80LZa0Zu3L1q%2BNkqG8rhhkwLvzWByHmpsW4EeZ1R3PxzEQGXSXr0aHrVrHbvSr9G1jL9%2BD2a%2BZGb6J1wNrfqdCuPu%2Fze%2BJcHc8ljSb8w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 817119fcfd71a22e-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=e27dd79f-6ef2-4ea9-9fc0-f1b402e43a23&expiration=1729090093
Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame DEC8
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4396685237194775250

43 B
734 B

253ms
252ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4396685237194775250
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yi3tSz8AP38%2FKxX%2BwX6C9JUsIhs1T8l3usjPodCgYfxYnPhWdinthpJJ7t025GBwbttovWGMv2vOWjjFpg9c6%2FnEdDzxHyib8UQGSmGPOgoHZmB42mBIXPZvg1HHx2SQXIEcPY5U%2FAJYyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 817119fafaaca22e-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
an-x-request-uuid: 80bb2af1-c54e-499b-b772-43aafb5d2f73
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4396685237194775250
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame DEC8
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6098153373786994889&gdpr=0&gdpr_consent=

43 B
773 B

255ms
254ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6098153373786994889&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PDHKlTTo%2Fojn8ZOD3FUH5S%2FmJ%2BXpvJoFLRZ9dtOBjJK6tGrgs4xr8w%2BBOJR9novheedECElpSvrt7iGWwBNWPFG7pN42IiSdyrsL3v1BAUau1WseVn6vywv6nHGrfyCF5rX%2BNg%2FtG0ceXg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 817119fafa95a22e-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6098153373786994889&gdpr=0&gdpr_consent=
date: Mon, 16 Oct 2023 14:48:12 GMT
content-length: 0

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame DEC8 0
284 B 416ms
134ms Image
text/plain 34.227.12.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.227.12.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-227-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame DEC8 43 B
252 B 63ms
56ms Image
image/gif 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZS1NLM4NBN0.v9ejan-EtAAA%263485
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Ffinclan.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 64837
etag: "da1f1d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 817119fa49cba24a-YYZ
content-length: 43
expires: Tue, 17 Oct 2023 14:48:13 GMT

GET
H2

200

/ Show response
sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/ Frame 1F80
Redirect Chain

https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsync.richaudience.com%2F1a12a024f8f9561c49164bbaf87ed164%2F%3Fuid%3D[sas_uid]&gdpr=0&gdpr_consent=&nwid=2441/
https://sync.smartadserver.com/getuid?url=https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=[sas_uid]&gdpr=0&gdpr_consent=&nwid=2441/&cklb=1
https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=6098153373786994889

95 B
366 B

148ms
148ms

Document
image/png

168.119.146.39
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=6098153373786994889
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 168.119.146.39 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.39.146.119.168.clients.your-server.de
Software: nginx/1.14.1 / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-type: image/png
date: Mon, 16 Oct 2023 14:48:03 GMT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server: nginx/1.14.1
x-powered-by: PHP/8.2.4

Redirect headers

content-length: 0
date: Mon, 16 Oct 2023 14:48:14 GMT
location: https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=6098153373786994889

GET
H2 200 sync
visitor.omnitagjs.com/visitor/ Frame 25D4 49 B
201 B 61ms
60ms Image
image/gif 195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=6098153373786994889&name=SMARTADSERVER&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 25D4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=

43 B
425 B

367ms
129ms

Image
image/gif

23.105.14.105
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 23.105.14.105 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS: 23.105.14.105.rdns.racklot.com
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Kestrel
content-length: 299

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 25D4 43 B
235 B 71ms
66ms Image
image/gif 35.211.178.172
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame 25D4
Redirect Chain

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=&_bee_ppp=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AAJZ7E7KWpoAABxo6KAAXg&partnerid=127&gdpr=0

43 B
412 B

264ms
54ms

Image
image/gif

23.105.14.105
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AAJZ7E7KWpoAABxo6KAAXg&partnerid=127&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 23.105.14.105 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS: 23.105.14.105.rdns.racklot.com
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir?partneruserid=AAJZ7E7KWpoAABxo6KAAXg&partnerid=127&gdpr=0
Date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 25D4
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=465339747295874670&gdpr=0&gdpr_consent=

43 B
407 B

290ms
129ms

Image
image/gif

23.105.14.105
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=465339747295874670&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 23.105.14.105 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS: 23.105.14.105.rdns.racklot.com
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=465339747295874670&gdpr=0&gdpr_consent=
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

cksync.php Show response
contextual.media.net/ Frame BD84
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted&zcc=1&cb=1697467693390
https://ad.turn.com/r/cs?pid=45&rndcb=8640505221
https://sync.1rx.io/usersync/turn/3408878892399404145?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005?redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Dr1%2...
https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=r1&refUrl=&vid=74676931033404692936510273000V10&ovsid=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005

53 B
470 B

484ms
484ms

Document
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=r1&refUrl=&vid=74676931033404692936510273000V10&ovsid=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 53
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:14 GMT
expires: Mon, 16 Oct 2023 14:48:14 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Mon, 16 Oct 2023 14:48:14 GMT
ETag: RX75fe741e953d486fa5b7d27d0cdd23e9005
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=r1&refUrl=&vid=74676931033404692936510273000V10&ovsid=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server: Tengine
Transfer-Encoding: chunked

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 0471 43 B
855 B 117ms
72ms Document
image/gif 52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 16 Oct 2023 14:48:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 4249EQPPWGC9CD8T37AK

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 136E
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFKWjdFN0tXcG9BQUJ4bzZLQUFYZw&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://sync.technoratimedia.com/services?uid=AAJZ7E7KWpoAABxo6KAAXg&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_cu...
https://ad.360yield.com/server_match?partner_id=1669&r=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26nuid%3D25798003961C4C21860E6593C1D9BD74%26att%3D1%26pid%3D79%26cb%3Dhttps%253A%...
https://sync.technoratimedia.com/services?srv=cs&nuid=25798003961C4C21860E6593C1D9BD74&att=1&pid=79&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2
https://rtb-csync.smartadserver.com/redir?partneruserid=AAJZ7E7KWpoAABxo6KAAXg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=6098153373786994889&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?ev=AAJZ7E7KWpoAABxo6KAAXg&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D6098153373786994889%26gdpr%3D0%26gdpr_consen...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=6098153373786994889&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAJZ7E7...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAJZ7E7KWpoAABxo6KAAXg&gdpr=0&gdpr_consent=

42 B
97 B

84ms
84ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAJZ7E7KWpoAABxo6KAAXg&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Mon, 16 Oct 2023 14:48:14 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAJZ7E7KWpoAABxo6KAAXg&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame 9635
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4396685237194775250&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

0
291 B

51ms
48ms

Document
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

content-length: 157
content-type: text/html; charset=utf-8
date: Mon, 16 Oct 2023 14:48:12 GMT
location: https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 6209 0
339 B 362ms
122ms Document
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 Miami, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET

b9pj45k4
sync-tm.everesttech.net/ct/upi/pid/ Frame 8988
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

0
0

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 8583
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=0860f904-6c33-11ee-b796-513f7a0db77c
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
0

98ms
97ms

Document
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame D5FC
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=YHanyWInp8l7dKWebnG4zjd3pJ97d6SYYnFgpu85

42 B
339 B

86ms
85ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=YHanyWInp8l7dKWebnG4zjd3pJ97d6SYYnFgpu85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=YHanyWInp8l7dKWebnG4zjd3pJ97d6SYYnFgpu85
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame B094
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=FXaDR_kJXJ5EqdAa_VEV20YcYY4&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:567723fc-c322-402b-9852-f55999614c89&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
0

61ms
61ms

Document
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 16 Oct 2023 14:48:14 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 22B3
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://p.rfihub.com/cm?in=1&pub=20513&ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=968625792217438120&expires=30&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
0

61ms
60ms

Document
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 0FAE
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
95 B

83ms
83ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:12 GMT
expires: Mon, 16 Oct 2023 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 1006614
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 2496
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314644403853212

42 B
194 B

113ms
112ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314644403853212
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Mon, 16 Oct 2023 14:48:13 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314644403853212
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 804D 0
0

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame EBA3
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:0X2GOaja1QSoTb5&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
0

136ms
136ms

Document
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 6E9C
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=869acff7-e3f7-4ee9-b3d1-73b45241e0e2&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

42 B
493 B

57ms
56ms

Document
image/gif

3.224.166.52
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.166.52 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-166-52.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Mon, 16 Oct 2023 14:48:13 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

/ Show response
onetag-sys.com/match/ Frame E5C2
Redirect Chain

https://b1sync.zemanta.com/usersync/pubmatic/?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:-DO3LFenhTo6u7eTibx6&gdpr=0&gdpr_consent=&gdpr=0
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

0
291 B

62ms
62ms

Document
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

Redirect headers

content-length: 157
content-type: text/html; charset=utf-8
date: Mon, 16 Oct 2023 14:48:12 GMT
location: https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame CD38
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
422 B

135ms
126ms

Document
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 817119fcbd8fa217-YYZ
content-length: 43
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 817119fbac1fa217-YYZ
content-type: text/html
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 779

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame BA10
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU5d6484a8f6a941c38a8f55ea467b824a

42 B
280 B

93ms
92ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU5d6484a8f6a941c38a8f55ea467b824a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU5d6484a8f6a941c38a8f55ea467b824a
pragma: no-cache
server: nginx

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2501
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ze4CcXhyR7GK8V7GfYmp6A%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

69ms
67ms

Image
text/html

69.192.109.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 69.192.109.53 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-109-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: gzip
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=121581
accept-ranges: bytes
content-length: 5606
expires: Wed, 18 Oct 2023 00:34:34 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 2501
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D191342ee-83f6-464d-8889-cb63456fece9%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=4396685237194775250&pt=191342ee-83f6-464d-8889-cb63456fece9%2C%2C

95 B
124 B

119ms
118ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=4396685237194775250&pt=191342ee-83f6-464d-8889-cb63456fece9%2C%2C

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
an-x-request-uuid: e803ca53-785c-45f1-b48c-932224a8e96d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=4396685237194775250&pt=191342ee-83f6-464d-8889-cb63456fece9%2C%2C
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 403 FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame 2501 0
0 407ms
134ms Image
text/html 40.76.134.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%20CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&rnd=RND
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame 2501
Redirect Chain

https://eb2.3lift.com/xuid?mid=7976&xuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&dongle=u6nf&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

37 B
353 B

118ms
117ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7976&xuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2501
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0RFRTAyNzEtNzg3Mi00N0IxLThBRjEtNUVDNjdEODlBOUU4&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:53ed4771-f8fe-4acd-9492-04ee503f4a38&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

95ms
94ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:53ed4771-f8fe-4acd-9492-04ee503f4a38&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:53ed4771-f8fe-4acd-9492-04ee503f4a38&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Mon, 16 Oct 2023 14:48:14 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=2999
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2501
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEF7P_abpbXPO6ryqsIats9g&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:4f2c5615-bf0c-47ac-9074-9b5d7b91d5c7&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

68ms
68ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:4f2c5615-bf0c-47ac-9074-9b5d7b91d5c7&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:4f2c5615-bf0c-47ac-9074-9b5d7b91d5c7&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Mon, 16 Oct 2023 14:48:14 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=2998
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 2501
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C228CB6BDC8E4C60A3FB9543C4F89776
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}

0
59 B

106ms
105ms

Image
text/plain

8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

/
onetag-sys.com/match/ Frame 2501
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

0
291 B

58ms
54ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
date: Mon, 16 Oct 2023 14:48:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 157
content-type: text/html; charset=utf-8

GET
H2 200 CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 2501 43 B
603 B 69ms
55ms Image
image/gif 2600:1f18:4e9:5a01:3a63:cfe:3dc:4ef6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/CDEE0271-7872-47B1-8AF1-5EC67D89A9E8?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:3a63:cfe:3dc:4ef6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 2501
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-lcNQTQNE2uVf.UOCF7BVG.xOBpTLsY8-~A&gdpr=0

0
129 B

312ms
94ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-lcNQTQNE2uVf.UOCF7BVG.xOBpTLsY8-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-lcNQTQNE2uVf.UOCF7BVG.xOBpTLsY8-~A&gdpr=0
date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 2501
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=74179480-c063-401c-8595-aa803dd4fb5e&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

0
291 B

59ms
54ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 157
content-type: text/html; charset=utf-8

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2501
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=501fce88ebe2125a&is_secure=true&networkId=17100&version=1&nuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAFydzZboTMhwMRlFKVAAAAAAA&expiration=1697554093&nuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&...

42 B
316 B

78ms
77ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAFydzZboTMhwMRlFKVAAAAAAA&expiration=1697554093&nuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAFydzZboTMhwMRlFKVAAAAAAA&expiration=1697554093&nuid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 2501 0
285 B 396ms
133ms Image
text/plain 34.227.12.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.227.12.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-227-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 2501
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=0534ef81-472b-485e-8298-1928a98071c0-652d4d2c-4341&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

0
291 B

68ms
68ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8
date: Mon, 16 Oct 2023 14:48:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 157
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 2501
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_10AA5491F_4B949B7C&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

55ms
54ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

HTTP/1.1

Server

38.98.69.175 New York, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-380472493; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-380472493; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Mon, 16 Oct 2023 14:48:12 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2501
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3408878892399404145&gdpr=0&gdpr_consent=&us_privacy=

1 B
220 B

103ms
98ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3408878892399404145&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3408878892399404145&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2501
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1815576651634497032

42 B
244 B

91ms
88ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1815576651634497032
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1815576651634497032
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 jquery-3.6.0.min.js Show response
finclan.com/ezossp/https/code.jquery.com/ 92 KB
30 KB 83ms
78ms Script
application/javascript 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/ezossp/https/code.jquery.com/jquery-3.6.0.min.js?screx=1&sxcb=19a
Requested by: Host: finclan.com
URL: https://finclan.com/tardisrocinante/screx.js?gcb=2&cb=4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: 1d25d2ac8d3bb3bdcae34781cfcb15d32e0002da78a61cc4f488068b1c5b5827

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 UTC
content-encoding: br
via: 1.1 varnish, 1.1 varnish
age: 2228279
x-ezoic-cdn: Hit ds;mm;f295459b032e34bb4c26c2637dc8e5d3;2-152251-62;694110cc-aa8c-4408-4f43-0f29f0f24832
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-served-by: cache-lga21931-LGA, cache-iad-kiad7000169-IAD
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-ez-proxy-out: true 2.4
x-timer: S1697466379.841294,VS0,VE0
etag: W/"28feccc0-15d9d-gzip"
x-origin-cache-control: public, max-age=31536000, stale-while-revalidate=604800
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
x-cache-hits: 15, 173386

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 315 B
167 B 151ms
150ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1004609327939326&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1%7C1x1%7C1x1&ifi=19&didk=1059404481&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693178&lmt=1697492893&adxs=566&adys=949&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x91&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D3453499716755464%26eid%3D3453499716755464%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1021%26sap%3D1320%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dfinclan_com-medrectangle-3-3453499716755464%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D217%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D220%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7%2C8%2C9%2C10%2C835%26ax_ssid%3D10082%26lb%3D220%26reqt%3D1697467692148&cust_params=amznbid%3D0%26amznp%3D0&adks=735801982&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d5e9957f649cd943df80a15edece81f56cca5274c6ab28379f193127f352645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK log
c21lg-d.media.net/ Frame 71B7 35 B
296 B 416ms
148ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-c&ovsid=Ez_v02cbDFgDBhipgyOJnqsV3Tz2Nfq_&cs=15&vsid=3404692936510273000V10
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-220-66.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 16 Oct 2023 14:48:13 GMT

GET
BLOB 200
OK 365ef067-aab0-4d88-9d75-e66523e457ff
https://prebid.a-mo.net/ Frame 5471 172 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://prebid.a-mo.net/365ef067-aab0-4d88-9d75-e66523e457ff
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c6d62752dfbd78fc41802271eeeb4ca52476466e374194344f10ad36db7a5f2

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 172
Content-Type

GET
H2

200

e44e40eb-782a-5321-bf2b-ea92da06a7bf Show response
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame CED3
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1&rts=-1249816368190419057
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e44e40eb-782a-5321-bf2b-ea92da06a7bf

0
573 B

156ms
156ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e44e40eb-782a-5321-bf2b-ea92da06a7bf
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 817119ffbcea36d8-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:14 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
location: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e44e40eb-782a-5321-bf2b-ea92da06a7bf

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 3F03 7 B
790 B 70ms
70ms XHR
application/json 8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1---
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H2

200

b6c0feab1763af271f181bc843e1e9ee710e4541a55e76d4eb980e0087d989f6 Show response
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame BB04
Redirect Chain

https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/b6c0feab1763af271f181bc843e1e9ee710e4541a55e76d4eb980e0087d989f6

0
497 B

154ms
154ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/b6c0feab1763af271f181bc843e1e9ee710e4541a55e76d4eb980e0087d989f6
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 817119fd2fa536d8-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Mon, 16 Oct 2023 14:48:13 GMT
Expires: 0
Location: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/b6c0feab1763af271f181bc843e1e9ee710e4541a55e76d4eb980e0087d989f6
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 4D1C 38 KB
11 KB 154ms
73ms Script
text/html 104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c32e49d778bd9d7756254a90139f62469a8a2a7f6e29be2144f804eb41fdf801

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 20:54:07 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=21822
Connection: keep-alive
Content-Length: 10838
Expires: Mon, 16 Oct 2023 20:51:55 GMT

GET
H2 200 cookie Show response
cm.adform.net/ Frame D005 43 B
105 B 266ms
266ms Document
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 43
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:13 GMT
server: nginx

GET
H2 200 gtm.js Show response
finclan.com/ezossp/https/www.googletagmanager.com/ 202 KB
67 KB 93ms
93ms Script
application/javascript 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://finclan.com/ezossp/https/www.googletagmanager.com/gtm.js?screx=1&sxcb=2&id=GTM-MF5RX8Q

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

60eee41459d3baf875dbcd55acab422d40a53ca9ac8380459d9bec52e1897055

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 UTC
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
x-ezoic-cdn: Hit ds;mm;62de42de2908cfd6e7fed67283878365;2-152251-62;8a8f2c7a-3ee1-4dc6-6cb0-a1d5f747bc8a
x-middleton-display: staticcontent_sol
cross-origin-resource-policy: cross-origin
x-middleton-response: 200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 12:00:00 GMT
server: Google Tag Manager
x-ez-proxy-out: true 2.4
x-origin-cache-control: private, max-age=900
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control

GET
H2 204 g3cpjyobp4 Show response
www.clarity.ms/tag/ 0
215 B 219ms
71ms Script
text/plain 2620:1ec:48:1::38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/g3cpjyobp4?ref=bwt
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:48:1::38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
x-azure-ref: 0LU0tZQAAAABqC7WYvgx8Q4gtDg8X0f3SWVRPMjIxMDkwODE3MDMzADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
x-cache: CONFIG_NOCACHE
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608

GET
H2 200 plugins.js Show response
finclan.com/assets/js/ 234 KB
57 KB 170ms
169ms Script
application/javascript 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://finclan.com/assets/js/plugins.js?screx=1&sxcb=19a

Requested by

Host: finclan.com
URL: https://finclan.com/tardisrocinante/screx.js?gcb=2&cb=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx /

Resource Hash

94b428dbd9e6674e618b5b5c16df7561fe274b810c1bfbf11382b30b7d9e0bce

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 UTC
content-encoding: br
strict-transport-security: max-age=15768000;
display: staticcontent_sol
x-ezoic-cdn: Hit ds;mm;0f40f0f1ae528d46ecc0410dd7b0d89e;2-152251-62;d266f336-0085-4d12-6959-48a0c3161011
x-middleton-display: staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Thu, 14 Jul 2022 02:30:16 GMT
server: nginx
x-ez-proxy-out: true 2.4
etag: W/"62cf7fb8-37d95-gzip"
x-origin-cache-control: max-age=315360000
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800

GET
H2 200 clipboard.min-f06c52bfddb458ad87349acf9fac06c5.js Show response
finclan.com/assets/js/ 11 KB
3 KB 77ms
76ms Script
application/javascript 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://finclan.com/assets/js/clipboard.min-f06c52bfddb458ad87349acf9fac06c5.js?screx=1&sxcb=19a

Requested by

Host: finclan.com
URL: https://finclan.com/tardisrocinante/screx.js?gcb=2&cb=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx /

Resource Hash

a38018a5c3abbc0dbf814a9f79286497360dfa9a9286849bb4cc29e4c50a6313

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 UTC
content-encoding: br
strict-transport-security: max-age=15768000;
display: staticcontent_sol
x-ezoic-cdn: Hit ds;mm;77b4704adce6b4275a48ff22f2d28831;2-152251-62;3b157e25-a483-4e13-6f92-5d43401b14e7
x-middleton-display: staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Thu, 14 Jul 2022 02:30:16 GMT
server: nginx
x-ez-proxy-out: true 2.4
etag: W/"62cf7fb8-2a04-gzip"
x-origin-cache-control: max-age=315360000
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
166 B 619ms
618ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=2692060218797065&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=20&didk=1483115518&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693341&lmt=1697492893&adxs=962&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Db355e9227b551c119a30a68852723b62%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D90%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D180%26reqt%3D1697467692319&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209333&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a70d78cd9bbd98ea1594a6cef35023069dbf084b11083cfde9592b65c29fd80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
165 B 646ms
645ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3532167804362045&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=21&didk=2618579448&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693347&lmt=1697492893&adxs=315&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Db355e9227b551c119a30a68852723b62%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D90%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D180%26reqt%3D1697467692318&cust_params=amznbid%3D0%26amznp%3D0&adks=414029443&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18c2ce631538405f4b9f69b5ce2e2648e1ad42dacf0e3a801ca8372cd3a5f151

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
165 B 644ms
639ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3266663914609404&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=22&didk=1483115519&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693351&lmt=1697492893&adxs=638&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Db355e9227b551c119a30a68852723b62%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D90%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D180%26reqt%3D1697467692315&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209332&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fea4b6ae6aad55c0efb042eedbea47690653c01a92bea8e581f93fcfcf56c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 381 B
163 B 549ms
544ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1498374171940303&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ifi=23&didk=2618578417&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693361&lmt=1697492893&adxs=566&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x60&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D7369173194762219%26eid%3D7369173194762219%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1114%26sap%3D1114%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dfinclan_com-box-3-7369173194762219%26eb_br%3Daf063c244089b52ec5a0423a258f1f8e%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D234%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D140%26br2%3D280%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2764%2C2765%2C3455%2C3456%2C3684%2C4184%2C9%2C10%2C11%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3455%2C3456%2C3684%2C4184%2C7%2C8%2C9%2C10%2C11%2C835%26ax_ssid%3D10082%26lb%3D280%26reqt%3D1697467692321&cust_params=amznbid%3D0%26amznp%3D0&adks=3394468990&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0fd31dbe93170ad6e68588d6b49f9722b4d8b458c2f2307844d6549fa317c83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 383 B
167 B 618ms
617ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1424331779804083&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=24&didk=3980644605&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693367&lmt=1697492893&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D2628239510760259%26eid%3D2628239510760259%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1976%26sap%3D1976%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dfinclan_com-edge-2-2628239510760259%26eb_br%3Db355e9227b551c119a30a68852723b62%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D190%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26hb_bidder%3Donetag%26hb_adid%3D1307f78e5eb66b31%26hb_format%3Dbanner%26hb_ssid%3D11291%26hb_opt%3D0.56%26hb_rt%3Dclient%26lb%3D180%26reqt%3D1697467692321&cust_params=amznbid%3D0%26amznp%3D0&adks=1968572909&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4f748d0cd4cf435239b23e9f2b4756b8711a842a81a1a74d016b71d1de38294

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 383 B
167 B 646ms
646ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1825756887982241&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=25&didk=3980648260&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693371&lmt=1697492893&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D9062749612755322%26eid%3D9062749612755322%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1975%26sap%3D1975%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dfinclan_com-edge-1-9062749612755322%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D184%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D100%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4184%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C7%2C8%2C9%2C10%2C835%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D135e53e35cb6b75e%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.82%26hb_rt%3Dclient%26lb%3D200%26reqt%3D1697467692320&cust_params=amznbid%3D0%26amznp%3D0&adks=2043483273&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8078e5f17923464cfa71d5acd330eab7a4d2f8d3fcd6d08d23ec3103f3cc0546

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame AC6D 38 KB
11 KB 96ms
96ms Script
text/html 104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c32e49d778bd9d7756254a90139f62469a8a2a7f6e29be2144f804eb41fdf801

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 20:54:07 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=21822
Connection: keep-alive
Content-Length: 10838
Expires: Mon, 16 Oct 2023 20:51:55 GMT

GET

image.sbmx
global.ib-ibi.com/ Frame C5EF
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?gdprapplies=0&gdpr=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fcriteo%2F%24%7BCRITEO_USER_ID%7D&profile=230
https://x.bidswitch.net/sync?ssp=criteo&custom_data=2VWgeV9VSm41N3p2Z0NMV1p3d2xZckdRcHclMkZlYkJrUiUyRiUyRmZWY2xnbFR3MWlJUE12TVA5NTZBMXlHWDNpbmZxMnpCSEp3TXhQdHdCdkRDT25lVmpTZU1WdDI5WDVlclVZMXhtZmluV...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=a77dcf3e-0a02-43b0-ba25-509c697b290e&ssp=criteo&gdpr=&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10594225550431058091&ssp=criteo&gdpr=&gdpr_consent=

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3F03
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1---
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDViZmU2MWQxY2U1YmQxNTQ1MTM3MDBhZjA4NzMxZWRlNmRiYTdkNA&us_privacy=1---

170 B
188 B

74ms
71ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDViZmU2MWQxY2U1YmQxNTQ1MTM3MDBhZjA4NzMxZWRlNmRiYTdkNA&us_privacy=1---

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDViZmU2MWQxY2U1YmQxNTQ1MTM3MDBhZjA4NzMxZWRlNmRiYTdkNA&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3F03
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=&expires=30

42 B
703 B

67ms
63ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=&expires=30
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f10fca9b-fb3f-404c-b66c-35ce97d5eea1&gdpr=0&gdpr_consent=&expires=30
date: Mon, 16 Oct 2023 14:48:13 GMT
server: Kestrel
content-length: 289

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 3F03
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1---
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LNT0FNR4-24-IKB9&us_privacy=1---

0
516 B

286ms
124ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LNT0FNR4-24-IKB9&us_privacy=1---
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 0C14B827AFF54597B6AB44A439CDDD55 Ref B: YTO01EDGE0508 Ref C: 2023-10-16T14:48:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYH1n7q6a3wRPuhcK3D8Q==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LNT0FNR4-24-IKB9&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 3F03 43 B
855 B 825ms
217ms Image
image/gif 67.220.228.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1---

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.220.228.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: CKE8DB5VGT7SH90BNZBR
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3F03
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKj5qImGZMRfT9hKiWu4l5s&google_cver=1

42 B
703 B

69ms
66ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKj5qImGZMRfT9hKiWu4l5s&google_cver=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c52bde874ac36e8646ae455e9e84952e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKj5qImGZMRfT9hKiWu4l5s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3F03
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1---
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TE5UMEZOUjQtMjQtSUtCOQ==&us_privacy=1---
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHIGn3uxYWgEs6dwCndQH6c&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TE5UMEZOUjQtMjQtSUtCOQ==&google_push=

170 B
188 B

72ms
72ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TE5UMEZOUjQtMjQtSUtCOQ==&google_push=

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TE5UMEZOUjQtMjQtSUtCOQ==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c52bde874ac36e8646ae455e9e84952e
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3F03
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1---
https://pr-bh.ybp.yahoo.com/sync/rubicon/KSgQEnsahqnQ80MXcCbFPsn5EUdSAgOZEtemQ7w0kco?csrc=&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-hoa42elE2oKSBtCU7FWi.75goBurR8mc9nwsxQ--~A

42 B
703 B

73ms
72ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-hoa42elE2oKSBtCU7FWi.75goBurR8mc9nwsxQ--~A
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: e1bf03b8e0c0366715a8d9abd31b9f35
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-hoa42elE2oKSBtCU7FWi.75goBurR8mc9nwsxQ--~A
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 3F03
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1---
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=mr82r1HQRJOjdGIg1RS0Rw&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=mr82r1HQRJOjdGIg1RS0Rw

43 B
479 B

70ms
68ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=mr82r1HQRJOjdGIg1RS0Rw

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JNGZRJM9Z5KRVCAZPZD2
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=mr82r1HQRJOjdGIg1RS0Rw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3F03
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAJZ7E7KWpoAABxo6KAAXg&expires=30

42 B
703 B

68ms
68ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAJZ7E7KWpoAABxo6KAAXg&expires=30
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: e1bf03b8e0c0366715a8d9abd31b9f35
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAJZ7E7KWpoAABxo6KAAXg&expires=30
Date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 3F03
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1&us_privacy=1---
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LNT0FNR4-24-IKB9&us_privacy=1---

95 B
124 B

96ms
94ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LNT0FNR4-24-IKB9&us_privacy=1---

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

a23-218-217-46.deploy.static.akamaitechnologies.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LNT0FNR4-24-IKB9&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame 3F03
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&us_privacy=1---
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LNT0FNR4-24-IKB9&us_privacy=1---
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LNT0FNR4-24-IKB9
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LNT0FNR4-24-IKB9&ckls=true&ci=cPymD4PJnF&nc=false&trid=-114751746

43 B
1 KB

338ms
150ms

Image
image/gif

3.162.125.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LNT0FNR4-24-IKB9&ckls=true&ci=cPymD4PJnF&nc=false&trid=-114751746
Protocol: H2
Server: 3.162.125.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-125-119.iad61.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
via: 1.1 44b13d2e12ad74e58c5a56d9c368da6c.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD61-P3
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: KRoR_I7zsM5c_wG2frLkXc__bo6TINYtULmay_eklGjuiswzWtc5Eg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
via: 1.1 c1cecf43ad8e18f031edf5229ce4289c.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD61-P3
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LNT0FNR4-24-IKB9&ckls=true&ci=cPymD4PJnF&nc=false&trid=-114751746
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: rmppBeklIDG-qCkavm_Dh3LbF-hYXTul3ukB9AkeK9IBcBXWpERMeg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3F03
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&us_privacy=1---
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LNT0FNR4-24-IKB9&us_privacy=1---

68 B
279 B

62ms
57ms

Image
image/png

3.214.6.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LNT0FNR4-24-IKB9&us_privacy=1---
Protocol: H2
Server: 3.214.6.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-6-158.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LNT0FNR4-24-IKB9&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 3F03
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=74179480-c063-401c-8595-aa803dd4fb5e&expires=30&us_privacy=1---

42 B
703 B

67ms
66ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=74179480-c063-401c-8595-aa803dd4fb5e&expires=30&us_privacy=1---
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c52bde874ac36e8646ae455e9e84952e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=74179480-c063-401c-8595-aa803dd4fb5e&expires=30&us_privacy=1---
Date: Mon, 16 Oct 2023 14:48:13 GMT
Connection: keep-alive
X-CI-RTID: ca7d1d16-0be2-4ebe-8350-5e834c15c3be
Content-Length: 164
Content-Type: text/html; charset=utf-8

GET
H2

200

cksync
hb.yahoo.net/ Frame 3F03
Redirect Chain

https://token.rubiconproject.com/token?pid=26594&us_privacy=1---
https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LNT0FNR4-24-IKB9&redir=true&us_privacy=1---
https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LNT0FNR4-24-IKB9&redir=true&us_privacy=1---
https://hb.yahoo.net/cksync?cs=63&axid_e=eS1VUW9ORnkxRTJ1SDBpM1JfeVhDYlVMNmxFX09wLlA5bX5B&ovsid=LNT0FNR4-24-IKB9&dpid=58160&us_privacy=1---

53 B
646 B

381ms
134ms

Image
image/gif

23.218.217.46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hb.yahoo.net/cksync?cs=63&axid_e=eS1VUW9ORnkxRTJ1SDBpM1JfeVhDYlVMNmxFX09wLlA5bX5B&ovsid=LNT0FNR4-24-IKB9&dpid=58160&us_privacy=1---

Protocol

Server

23.218.217.46 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Mon, 16 Oct 2023 14:48:14 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:14 GMT

Redirect headers

location: https://hb.yahoo.net/cksync?cs=63&axid_e=eS1VUW9ORnkxRTJ1SDBpM1JfeVhDYlVMNmxFX09wLlA5bX5B&ovsid=LNT0FNR4-24-IKB9&dpid=58160&us_privacy=1---
date: Mon, 16 Oct 2023 14:48:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame 3F03
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&us_privacy=1---
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LNT0FNR4-24-IKB9&us_privacy=1---

43 B
1 KB

63ms
62ms

Image
image/gif

68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LNT0FNR4-24-IKB9&us_privacy=1---

Protocol

Server

68.67.160.24 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
an-x-request-uuid: ff273ce6-bb91-41a8-9dbb-5359e6d75601
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LNT0FNR4-24-IKB9&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bf03b8e0c0366715a8d9abd31b9f35
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 3F03
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&us_privacy=1---
https://ce.lijit.com/merge?pid=80&3pid=LNT0FNR4-24-IKB9&us_privacy=1---

43 B
664 B

395ms
127ms

Image
image/gif

63.251.114.137
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LNT0FNR4-24-IKB9&us_privacy=1---
Protocol: HTTP/1.1
Server: 63.251.114.137 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:14 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap6ewr1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LNT0FNR4-24-IKB9&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bf03b8e0c0366715a8d9abd31b9f35
Expires: 0

GET
H2

200

171b56b8ab509c422f85cb41e328e184 Show response
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 5D0B
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
https://csync.smilewanted.com/set_partner_userid_get/freewheel/171b56b8ab509c422f85cb41e328e184?gdpr_consent=&gdpr=0

0
660 B

153ms
149ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/freewheel/171b56b8ab509c422f85cb41e328e184?gdpr_consent=&gdpr=0
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 817119fc7e6d36d8-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Date: Mon, 16 Oct 2023 14:48:13 GMT
Location: https://csync.smilewanted.com/set_partner_userid_get/freewheel/171b56b8ab509c422f85cb41e328e184?gdpr_consent=&gdpr=0
Pragma: no-cache
Server: nginx
x-sticky-vk: 1697467693477007-1172

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
173 B 657ms
656ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=85159781858628&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=26&didk=1059391305&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693410&lmt=1697492893&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D8831122984812716%26eid%3D8831122984812716%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dfinclan_com-medrectangle-2-8831122984812716%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D15%26bvm%3D0%26bvr%3D5%26avc%3D153%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D100%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C57%2C66%2C20%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D1348c6e7204dd518%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.91%26hb_rt%3Dclient%26lb%3D180%26reqt%3D1697467692348&cust_params=amznbid%3D0%26amznp%3D0&adks=1011857618&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51f69e36431afe9ffc726f723a4796d29521bf318f25a08448e3b8ea2512bb11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

2b11c72a-9134-4ba2-97cc-495afc40a488 Show response
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 1DFC
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/2b11c72a-9134-4ba2-97cc-495afc40a488?gdpr=0

0
523 B

161ms
159ms

Document
text/html

172.67.10.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/2b11c72a-9134-4ba2-97cc-495afc40a488?gdpr=0
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csync.smilewanted.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 817119fcaeac36d8-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:13 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

content-length: 0
date: Mon, 16 Oct 2023 14:48:13 GMT
location: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/2b11c72a-9134-4ba2-97cc-495afc40a488?gdpr=0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 4D1C 7 B
790 B 103ms
66ms XHR
application/json 8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&khaos=LNT0FNR4-24-IKB9
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame F7AB 38 KB
11 KB 76ms
74ms Script
text/html 104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c32e49d778bd9d7756254a90139f62469a8a2a7f6e29be2144f804eb41fdf801

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=medianet
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 20:54:07 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=21822
Connection: keep-alive
Content-Length: 10838
Expires: Mon, 16 Oct 2023 20:51:55 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame AC6D 7 B
790 B 143ms
64ms XHR
application/json 8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&khaos=LNT0FNR4-24-IKB9
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H2 200 log
c21lg-d.media.net/ Frame 71B7 35 B
164 B 120ms
113ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-con&ovsid=50eee74c-411a-449b-8b69-a34a67b9b8f2&cs=15&vsid=3404692936510273000V10
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-220-66.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 16 Oct 2023 14:48:13 GMT
content-length: 35
content-type: image/gif

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 9F75 38 KB
11 KB 67ms
65ms Script
text/html 104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c32e49d778bd9d7756254a90139f62469a8a2a7f6e29be2144f804eb41fdf801

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:13 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 20:54:07 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=21822
Connection: keep-alive
Content-Length: 10838
Expires: Mon, 16 Oct 2023 20:51:55 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 69ms
69ms XHR
text/plain 2607:f8b0:4004:c17::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1288998357&t=pageview&_s=1&dl=https%3A%2F%2Ffinclan.com%2F&ul=en-us&de=UTF-8&dt=Best%20Bank%20Code%20Lookup%20Tool%20For%20IFSC%2C%20SWIFT%2C%20NSC%20Sort%20Code%2C%20Transit%20Number%2C%20Routing%20Number%2C%20Bank%20Branch%20Code%2C%20BSB%20And%20BIN%20Search%20At%20Finclan%20-%20Finclan.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCjAAEIZAAAAACAMI~&jid=898536516&gjid=775441651&cid=283721564.1697467689&tid=UA-121688438-1&_gid=1154807823.1697467690&_r=1&_slc=1&gtm=45He3ab0n81MF5RX8Q&z=334452009

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://finclan.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 61ms
60ms Script
text/javascript 2607:f8b0:4004:c17::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: finclan.com
URL: https://finclan.com/ezossp/https/www.googletagmanager.com/gtm.js?screx=1&sxcb=2&id=GTM-MF5RX8Q

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 16 Oct 2023 14:26:14 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 1319
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 16 Oct 2023 16:26:14 GMT

GET
H2 200 g3ct2p9tsh Show response
www.clarity.ms/tag/ 668 B
993 B 56ms
55ms Script
application/x-javascript 2620:1ec:48:1::38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/g3ct2p9tsh?ref=gtm2
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:48:1::38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 7992d2bf4703b22a76cc9211448bf3c792a3ffc139dc9e696ddae8a38bbe0395

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

request-context: appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
date: Mon, 16 Oct 2023 14:48:13 GMT
x-azure-ref: 0LU0tZQAAAAA8nvok+oi0RbGrWfhJeGXfWVRPMjIxMDkwODE3MDMzADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
content-length: 668
expires: -1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 237 KB
83 KB 337ms
115ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6GC0L92YPG&l=dataLayer&cx=c

Requested by

Host: finclan.com
URL: https://finclan.com/ezossp/https/www.googletagmanager.com/gtm.js?screx=1&sxcb=2&id=GTM-MF5RX8Q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d69c2410000b1b4a66598e1eb4c6bff894fc5f1ad763039926de7d27fafb9b7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 84294
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 16 Oct 2023 14:48:13 GMT

GET
H2

200

sync
visitor.omnitagjs.com/visitor/ Frame 4D1C
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=adyoulike&gdpr=0&gdpr_consent=&gdpr=0&khaos=LNT0FNR4-24-IKB9
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LNT0FNR4-24-IKB9&name=RUBICON&gdpr=0

49 B
178 B

91ms
91ms

Image
image/gif

195.244.31.11
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LNT0FNR4-24-IKB9&name=RUBICON&gdpr=0

Requested by

Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---

Protocol

Server

195.244.31.11 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LNT0FNR4-24-IKB9&name=RUBICON&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: deb9f124eecce7a554c70ca983265c95
Expires: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame F7AB 7 B
790 B 105ms
65ms XHR
application/json 8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=LNT0FNR4-24-IKB9
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 9F75 7 B
790 B 222ms
166ms XHR
application/json 8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0&khaos=LNT0FNR4-24-IKB9
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.12/ 58 KB
20 KB 37ms
37ms Script
application/javascript 2620:1ec:48:1::38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.12/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/g3ct2p9tsh?ref=gtm2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:48:1::38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 977a886e5d9068b3ed8dde6e511ca22ccf44cbed7fb881d0b8b74619fe462e21

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:51:26 GMT
x-azure-ref-originshield: 0WOEsZQAAAAAtzQshYDa+Q5BdpsmjbI+uTU5aMjIxMDYwNjEyMDMzADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
etag: "0x8DBCAC5BF4C06D9"
x-azure-ref: 0LU0tZQAAAAD/vOoSr/R6SYOdMi4NzDmzWVRPMjIxMDkwODE3MDMzADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
x-cache: TCP_HIT
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 67dfe24a-a01e-004f-3d7c-ff5f8f000000
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
accept-ranges: bytes

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=80F200C33A4A41C69AD4B53C7852E0EA&RedC=c.clarity.ms&MXFR=31506EC451D2698523287D6855D2679A
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=80F200C33A4A41C69AD4B53C7852E0EA&MUID=2C73069DD06C621C196D1531D1C663A6

42 B
442 B

52ms
52ms

Image
image/gif

20.110.205.119
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=80F200C33A4A41C69AD4B53C7852E0EA&MUID=2C73069DD06C621C196D1531D1C663A6
Protocol: H2
Server: 20.110.205.119 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
last-modified: Wed, 30 Aug 2023 15:12:15 GMT
server: Microsoft-IIS/10.0
etag: "3370fe5b54dbd91:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C6C53C0959844B309F5847E2ACDD915E Ref B: YTO01EDGE0516 Ref C: 2023-10-16T14:48:14Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=80F200C33A4A41C69AD4B53C7852E0EA&MUID=2C73069DD06C621C196D1531D1C663A6
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
233 B 66ms
65ms XHR
text/plain 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-121688438-1&cid=283721564.1697467689&jid=898536516&gjid=775441651&_gid=1154807823.1697467690&_u=aCjAAEIYAAAAACAMI~&z=32856629

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://finclan.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame F7AB
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=medianet&khaos=LNT0FNR4-24-IKB9
https://contextual.media.net/cksync.php?type=rbcn&ovsid=LNT0FNR4-24-IKB9

53 B
451 B

284ms
283ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=rbcn&ovsid=LNT0FNR4-24-IKB9

Requested by

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:14 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:14 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://contextual.media.net/cksync.php?type=rbcn&ovsid=LNT0FNR4-24-IKB9
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bf03b8e0c0366715a8d9abd31b9f35
Expires: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 315 B
166 B 158ms
157ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3930854548374509&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1%7C1x1%7C1x1&ifi=27&didk=1059404481&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693729&lmt=1697492893&adxs=566&adys=949&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x91&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D3453499716755464%26eid%3D3453499716755464%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1021%26sap%3D1320%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dfinclan_com-medrectangle-3-3453499716755464%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D217%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D220%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7%2C8%2C9%2C10%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3154%2C3684%2C4184%2C4276%2C7%2C8%2C9%2C10%2C835%26ax_ssid%3D10082%26lb%3D120%26reqt%3D1697467693716&cust_params=amznbid%3D0%26amznp%3D0&adks=735801982&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e3630e3765ecac331e9c75027a1376ed93b325f44d96840f44d43cd91f7dd69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
291 B 396ms
113ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.12/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://finclan.com
Date: Mon, 16 Oct 2023 14:48:14 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 96ms
93ms Image
image/gif 2607:f8b0:4004:c06::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-121688438-1&cid=283721564.1697467689&jid=898536516&_u=aCjAAEIYAAAAACAMI~&z=156662093

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::63 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 323ms
116ms Image
image/gif 2607:f8b0:4004:c0b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-121688438-1&cid=283721564.1697467689&jid=898536516&_u=aCjAAEIYAAAAACAMI~&z=156662093

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 6267 0
595 B 64ms
64ms Script
text/html 68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.24 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:13 GMT
an-x-request-uuid: e2c657a4-7255-4d3d-b91d-4f8f4dee2170
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 381 B
163 B 644ms
644ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1197847460112222&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ifi=28&didk=2618578417&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467693924&lmt=1697492893&adxs=566&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x60&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D7369173194762219%26eid%3D7369173194762219%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1114%26sap%3D1114%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dfinclan_com-box-3-7369173194762219%26eb_br%3D947f1d5169cc7d0f997560e34838fb04%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D234%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D42%26br2%3D280%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2764%2C2765%2C3455%2C3456%2C3684%2C4184%2C9%2C10%2C11%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3455%2C3456%2C3684%2C4184%2C7%2C8%2C9%2C10%2C11%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3455%2C3456%2C3684%2C4184%2C4276%2C7%2C8%2C9%2C10%2C11%2C835%26ax_ssid%3D10082%26lb%3D140%26reqt%3D1697467693917&cust_params=amznbid%3D0%26amznp%3D0&adks=3394468990&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44efaf5f532749ae11d417a94b424fe51f6413324e615a148f30afe9e332f1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
130 B 61ms
59ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDEwNDExOTUwMDc1NzI0OCIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJmaW5jbGFuX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMTYwMCwxMjAwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDEwNDExOTUwMDc1NzI0OCIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJmaW5jbGFuX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQxMDQxMTk1MDA3NTcyNDgiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZmluY2xhbl9jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiJ1bmRlZmluZWQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 68ms
68ms Ping
text/plain 2607:f8b0:4004:c17::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-6GC0L92YPG&gtm=45je3ab0&_p=1288998357&cid=283721564.1697467689&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1697467693&sct=1&seg=0&dl=https%3A%2F%2Ffinclan.com%2F&dt=Best%20Bank%20Code%20Lookup%20Tool%20For%20IFSC%2C%20SWIFT%2C%20NSC%20Sort%20Code%2C%20Transit%20Number%2C%20Routing%20Number%2C%20Bank%20Branch%20Code%2C%20BSB%20And%20BIN%20Search%20At%20Finclan%20-%20Finclan.com&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6GC0L92YPG&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c17::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://finclan.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
166 B 644ms
643ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1161972591553626&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=29&didk=1483115518&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467694021&lmt=1697492894&adxs=962&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Dbf9a045b836005b6c23b7b0749249612%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D26%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D90%26reqt%3D1697467694005&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209333&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

073165f8e625c778de40729f178060b0570cfcbe9495ce18da0fa8e65ab10ddd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
12 KB 602ms
602ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3488985463122519&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=30&didk=3980644605&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467694045&lmt=1697492894&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D2628239510760259%26eid%3D2628239510760259%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1976%26sap%3D1976%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dfinclan_com-edge-2-2628239510760259%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D190%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D50%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26hb_bidder%3Donetag%26hb_adid%3D1307f78e5eb66b31%26hb_format%3Dbanner%26hb_ssid%3D11291%26hb_opt%3D0.56%26hb_rt%3Dclient%26lb%3D90%26reqt%3D1697467694032%26nam%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=1968572909&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2fcbee214e38c0d1f54ccc3cff7320c772b0293081b047c73761d9a680a866b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11914
x-xss-protection: 0
google-lineitem-id: 5728075597
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138354425803
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
12 KB 610ms
609ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3827976734604377&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=31&didk=3980648260&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467694048&lmt=1697492894&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D9062749612755322%26eid%3D9062749612755322%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1975%26sap%3D1975%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dfinclan_com-edge-1-9062749612755322%26eb_br%3Ddfa60cee6e1053fc0c9e607c8047bd28%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D184%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D80%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4184%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C7%2C8%2C9%2C10%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3154%2C3684%2C4276%2C7%2C8%2C9%2C10%2C835%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D135e53e35cb6b75e%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.82%26hb_rt%3Dclient%26lb%3D100%26reqt%3D1697467694040%26nam%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=2043483273&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d0375c9abeb8dcb5a210a6fd9d133da464e8597e13303afd24401abd6a7662b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11896
x-xss-protection: 0
google-lineitem-id: 5728075597
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138354426988
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
165 B 616ms
616ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3115900540803047&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=32&didk=2618579448&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467694050&lmt=1697492894&adxs=315&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Dbf9a045b836005b6c23b7b0749249612%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D26%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D90%26reqt%3D1697467694035&cust_params=amznbid%3D0%26amznp%3D0&adks=414029443&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d9179f88cfb6b0bc82e06d1ccd043380ab4691d308ea8cbd04839eebad15b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 382 B
166 B 640ms
640ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=365204353842288&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=33&didk=1483115519&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467694053&lmt=1697492894&adxs=638&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Dbf9a045b836005b6c23b7b0749249612%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D26%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D90%26reqt%3D1697467694037&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209332&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2fbe10446bbe484a2a6e9d3af0b76b2737fa6d28817a65c566a122ff403e0c61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
12 KB 599ms
599ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=808880045208280&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=34&didk=1059391305&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467694085&lmt=1697492894&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D8831122984812716%26eid%3D8831122984812716%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dfinclan_com-medrectangle-2-8831122984812716%26eb_br%3Db355e9227b551c119a30a68852723b62%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D15%26bvm%3D0%26bvr%3D5%26avc%3D153%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D180%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C57%2C66%2C20%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6044%2C6045%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3154%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26hb_bidder%3Dmedianet%26hb_adid%3D1348c6e7204dd518%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_opt%3D0.91%26hb_rt%3Dclient%26lb%3D100%26reqt%3D1697467694082%26nam%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=1011857618&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7561e5a9423a14afc6d30283f916e90a33fc5d027952b0f078b3fcaaa99970d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12247
x-xss-protection: 0
google-lineitem-id: 5728075597
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138354426967
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8215 0
0 125ms
125ms Fetch
image/gif 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvsW4cNiYwUfYIfV7FLbLCt6H4wiwjGtjcpS4XxSiF8UIdMkGt0-qTwb8L4v6ryrqWtsUn8ocMeZXoanlDPid0pOiQ7m77_JnfoVCYH-vA78WDQ2Ft_D2ucpASRYrsHXDSc-Hc6q301bvXMVPlNCTX0iBZ1T3S5sa_9sBCNZgEQn3T5Tsc_t1qtE_X6Cm8oFPAo4yzQVJuEV-cj0BtLeSO_gdl8NLBpeRdbJYO5y8ksdprtMeFlQLLN1WfJF8_mqDQuTsrhv5ZhUMsWt7qGMeFMVAHdmHjbCkgyko2L42frEQ6O72VEyb8fUY0HkxOOmzOoELatm86CM3FK8Xt99K83lyEmwkqog_2hxA&sai=AMfl-YTLgVDNot50o7Wyg610rru8d0QKoQDtWlnclvGexCTRFeQKgH07Ie7veDJvChiHvvBLObMd5R3a4sNAprtBlqPh0md8CG4tVABAPB0onT7Li4PgG7h850VhBmwoLw&sig=Cg0ArKJSzJcQ25pokKu5EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 BannerAdBannerPlacement.js Show response
onetag-sys.com/static/ Frame 8215 26 KB
9 KB 73ms
73ms Script
application/javascript 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

d8a73607bb37cfd6ada8a3bcdd55aa671988b829b76e9d15833885b8a94f7bf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Mon, 01 Jan 2046 12:34:56 GMT
strict-transport-security: max-age=15552000
cache-control: public, max-age=2628000, immutable
content-encoding: gzip
content-length: 8618
vary: accept-encoding
content-type: application/javascript

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 69ms
69ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjYyODIzOTUxMDc2MDI1OSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwicmV2ZW51ZSI6MC4wMDA1NjYxNjMzNzI2MDAwMDAxLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjE5NzYsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDU2NjE2MzM3MjYwMDAwMDEsImJpZF9mbG9vcl9wcmV2Ijo1MCwic3RhdF9zb3VyY2VfaWQiOjExMjkxLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InN0YXRfc291cmNlX2lkIiwidmFsIjoiMTEyOTEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjI2MjgyMzk1MTA3NjAyNTkiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAuMDAwNTY2MTYzMzcyNjAwMDAwMSwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA1NjYxNjMzNzI2MDAwMDAxLCJiaWRfZmxvb3JfcHJldiI6NTAsInN0YXRfc291cmNlX2lkIjoxMTI5MSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyNjI4MjM5NTEwNzYwMjU5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTk3NiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiM2JhOTgyZmM0MjM4ZGQ0MTk3YjFkNTFiMzQ1NDc4ZGMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjI2MjgyMzk1MTA3NjAyNTkiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJtZWRpYV90eXBlIiwidmFsIjoiYmFubmVyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyNjI4MjM5NTEwNzYwMjU5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTk3NiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicHJlYmlkX3NvdXJjZSIsInZhbCI6ImNsaWVudCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 89ms
88ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjYyODIzOTUxMDc2MDI1OSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8215 187 KB
59 KB 70ms
69ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:14 GMT

GET
H2 204 ping
onetag-sys.com/v2/ Frame 8215 0
28 B 81ms
81ms Image
text/plain 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/v2/ping?data=q42ZO0ItMXxI9T45f-WnIYRL_cNNN5CvhNFiP7hkXy8C05SA07jAS-iopM2L3nXHIOpqQOeBIoEkulHfVuoUMK52U58b_nO7B277OIMWJ3YbqHOUVVLXJVbJfDbu3zSa2kvqA_VInt7OeGRdG-Ai2J8kZueMRSkYkOIJ2s0Ee7PYGyBvpPdecgVCD8bIv8QFWIVDbv7GgotX51oRw6VtKrkOoCqi9n2nD2VG5FIjUCU4yZG24N2eqhBscIAIzj5DaqJXOiChNikX6gcvzOdQoCmrc_QVYWBcFF3iGXGIPLEDFIE7_mwJDZJFIplr3hprLXik-myRH1iPW6MAuzqtaenoh2gGoIKN7xbiUAbw_JQOLdvn2xlc9FCpzMsENT5TdBeGbGXGA0fYhJ7a_dT8CuRn94rMJItl91DQhd6dmzSW-u_E6XalZoaiZM4_CDT0YQ1c8aEHnE4Cz52LmxsQLNaMOz5xc_7CdGPFX3OutVwQvewr-aULjcoBfQwMYmL-T-qK0zAtbl3oJ52flWmtVRS1NbPra9GXmRIbB8eOaoKB1p68iSXZrR-kZXLBLOh6aRyeWG-GoeB7YyR_z0uOxqmygKlinhqDnOVBgS_hGhHM91BrSvKZnTMXkBe2FGK-uidp6pnkKwxlKcTxzM11T6I_DqepHWEYx1WFfoi0PyK7ran1ct_GUa3cQWmxsUDv&event=115&price=&click=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 65ms
64ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjYyODIzOTUxMDc2MDI1OSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI1ODAzLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzNTQ0MjU4MDMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjI2MjgyMzk1MTA3NjAyNTkiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNTgwMywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNTcyODA3NTU5NyJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

GET
H3 200 5728075597 Show response
go.ezodn.com/dac/ 0
571 B 103ms
102ms XHR
text/plain 2606:4700:e2::ac40:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/5728075597
Requested by: Host: finclan.com
URL: https://finclan.com/porpoiseant/banger.js?cb=195-2&bv=276&v=99&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 0
last-modified: Mon, 16 Oct 2023 13:42:19 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://finclan.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bPt0EyghH1bknHnwZaQ0V7VB27iNXNi5VkwzzzWDVS262mCBkljjiYjPBmDAUqHXlAwf9Oz9hZjI0LGrL3hlNx6JRGg3DAC3pp2dtYbFCQxXkddmA%2FlVDVe6yEZ0DYz64Xv4o2yDKptrrzs%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 81711a042d0029a0-ORD
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
62 B 76ms
75ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjYyODIzOTUxMDc2MDI1OSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI1ODAzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMC0xNiJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiI0MjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 75ms
74ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMjYyODIzOTUxMDc2MDI1OSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYXVjdGlvbl9lcG9jaCI6MTY5NzQ2NzY5NSwiYWRfcG9zaXRpb24iOjE5NzYsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MzUwLCJiaWRfZmxvb3JfcHJldiI6OTAsImJpZF9mbG9vcl9maWxsZWQiOjI2LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo2NTIsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5N31d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame DF3C 0
0 131ms
130ms Fetch
image/gif 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssWa_PZLa2S3yl4mQCtDOmowP3FmFXwT6wYh25V0touaS3nqc7xUW4pBQYp2ZE45uIy2JvkdSMu9JqfNmn_ubcPsbVC7pdxH96W47e-tXJ7XvSPl7FkfV5iyvkDAwAhPzzSczCJYmtub8wZDE4bO1Yq9XRJMPTviU42tjcoaafWavq71RKiu6XmnhXAEm_panEA4nNtcMCBBkq2cr40BZEbgvmv-yu2LOtEG6XsBPVLY_F_whupIljUC1dxVFm6Esht9K1LJ-cPd9zoVHYAnfXdWuH3xUieZcNU_TfKnysmOqIsvHr1bfT-op9_JI0teDnOUKrdJ6HwGZC13f1LGRcHLVZ8ftdTsYeGEQ&sai=AMfl-YSzO0fzxn6E00IKnQBdwCHiCRO2UW-PKtGYgZQEhTt0B8dYEYthhB6ftq4EHbBjGoEOPDKxZoUxcb0rCbPCxlazUY7TDLpgY-nYKB6ch3CKsKpRlrlvIASjC9FDTA&sig=Cg0ArKJSzPhCcKEZCWpnEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 137C 684 B
439 B 94ms
80ms Document
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNWGBA55k-qbdvFfuRTU92sF2s507lIPk6xph8FjBC2Kk1FOoO9mwNk4dDQlG0Va6U0OnfCHh1n0V-JGNzUs3XgAQuomKywu7xB8yHlVSBjKH7LzdRc

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68e12a98552e1d10d74c35c38a6324b2ffc6e1b552ca386894875ee9b60ea169

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:14 GMT
expires: Mon, 16 Oct 2023 14:48:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3942 89 KB
31 KB 88ms
82ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:14 GMT

GET
H2

200

adview
adx.g.doubleclick.net/pagead/ Frame 3942
Redirect Chain

https://ghent-gce-sc.bidswitch.net/imp/1.036/BSWhttps_A_B_Badx.g.doubleclick.net_Bpagead_Badview_Cai_RCp2fvKE0tZY22FJOljvQPpfmxiAftlKCycpvX__dW7EMCNtwEQASCD__eYfYP2IiYHoA6ABzt__F7wLIAQmoAwHIA5sEqgT...
https://adx.g.doubleclick.net/pagead/adview?ai=Cp2fvKE0tZY22FJOljvQPpfmxiAftlKCycpvX_dW7EMCNtwEQASCD_eYfYP2IiYHoA6ABzt_F7wLIAQmoAwHIA5sEqgTkAU_Q0CmcS6IiNMMbmrwbc4WLa9STrFrRKCxNSk9iDGv6mGuTy4sTrBpNB...

0
0

369ms
127ms

Image
text/html

2607:f8b0:4004:c1d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://adx.g.doubleclick.net/pagead/adview?ai=Cp2fvKE0tZY22FJOljvQPpfmxiAftlKCycpvX_dW7EMCNtwEQASCD_eYfYP2IiYHoA6ABzt_F7wLIAQmoAwHIA5sEqgTkAU_Q0CmcS6IiNMMbmrwbc4WLa9STrFrRKCxNSk9iDGv6mGuTy4sTrBpNBhblguCS2AiKCAqvhkCwPazhw4Dz0qA_4SN0NppiCOHbrSphKVO3nbHeTmpcra-NFnRhAdD4A9FHb6wSpZ9CvxK3tobExQW6XIFbUITeM9Gk4YkjVNnO246p3lf3j7K1tdXFdkjoFHI5ewzUfsiD4Nz1zl53m8oSZ2YaDkvQhtyTjc32hcYwo9V90n4PQRo4QdaYdyZ5HKUnaepO42JIEvfYKGcytCOdbWLCxRbsSVzisJrz3E0HPRi9FMAEwLyGqNoD4AQDiAXaoN2PNpIFBAgDGASSBQYIGxABGAGSBQsIIhAFGAFIvfKLAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGTIAHmqC6kAGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChCsnj8YgI_lswHSCBQIgGEQARhfMgKKAjoCgEBIvf3BOvIIGWJpZGRlci1tZWRpYW5ldF84Q1VCQ0I2MTeACgTICwHaDBAKChCwrZzTmtKQ5UgSAgEDsBOpwZQVyBOsz4XeA9gTDYgUBtgUAdAVAYAXAbIXCAoGCAASABgA&sigh=nSo6E1pjhQ8&uach_m=[UACH]&ase=2&nis=4&pr=38:1.036&cid=CAQSMgDICaaNKY6exEGYVQsJlDpxH6lectWHIJ2z-ddKA5QnAjnWBRhuvuAdXhfrmEecT8dpGAE
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Redirect headers

Location: https://adx.g.doubleclick.net/pagead/adview?ai=Cp2fvKE0tZY22FJOljvQPpfmxiAftlKCycpvX_dW7EMCNtwEQASCD_eYfYP2IiYHoA6ABzt_F7wLIAQmoAwHIA5sEqgTkAU_Q0CmcS6IiNMMbmrwbc4WLa9STrFrRKCxNSk9iDGv6mGuTy4sTrBpNBhblguCS2AiKCAqvhkCwPazhw4Dz0qA_4SN0NppiCOHbrSphKVO3nbHeTmpcra-NFnRhAdD4A9FHb6wSpZ9CvxK3tobExQW6XIFbUITeM9Gk4YkjVNnO246p3lf3j7K1tdXFdkjoFHI5ewzUfsiD4Nz1zl53m8oSZ2YaDkvQhtyTjc32hcYwo9V90n4PQRo4QdaYdyZ5HKUnaepO42JIEvfYKGcytCOdbWLCxRbsSVzisJrz3E0HPRi9FMAEwLyGqNoD4AQDiAXaoN2PNpIFBAgDGASSBQYIGxABGAGSBQsIIhAFGAFIvfKLAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGTIAHmqC6kAGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChCsnj8YgI_lswHSCBQIgGEQARhfMgKKAjoCgEBIvf3BOvIIGWJpZGRlci1tZWRpYW5ldF84Q1VCQ0I2MTeACgTICwHaDBAKChCwrZzTmtKQ5UgSAgEDsBOpwZQVyBOsz4XeA9gTDYgUBtgUAdAVAYAXAbIXCAoGCAASABgA&sigh=nSo6E1pjhQ8&uach_m=[UACH]&ase=2&nis=4&pr=38:1.036&cid=CAQSMgDICaaNKY6exEGYVQsJlDpxH6lectWHIJ2z-ddKA5QnAjnWBRhuvuAdXhfrmEecT8dpGAE
Date: Mon, 16 Oct 2023 14:48:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2

200

cksync.php
contextual.media.net/ Frame 3942
Redirect Chain

https://us-east-sync.bidswitch.net/sync?ssp=medianet&dsp_id=16&imp=1
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp...
https://x.bidswitch.net/sync?dsp_id=440&ssp=medianet&user_id=8UcGu80jdZ79C8MOxWJq0
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=

53 B
463 B

366ms
366ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-76-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:15 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:15 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=
Date: Mon, 16 Oct 2023 14:48:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK medianet_bid
ghent-gce-sc.bidswitch.net/win_notice/ Frame 3942 43 B
183 B 404ms
135ms Image
image/gif 35.211.200.231
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ghent-gce-sc.bidswitch.net/win_notice/medianet_bid?rid=YS90MqRd5baaw-d_KBwrsmOBLDlQzTQR8avf9uDgGHj2ZY3CsUaBZ0h0sxQuVk1DR2VmyZCmcbSjUJ-Q0SJbCabbPEVT76SckzmZh28QJPMuWLCBfJDfyaXyh2Izuvex1dEKpadqEuF94JhGo7s8p4hWbblD3nt0Ux3kRZG6kLkwDij0-7iesJQgujb_iRDyA-xdVMTq2wrUp21IogaAM0WFw7v18SMdB4VHTRh_-tFWTc2YXQQVKrT615hJlCXA1M4fwlJnuTpmlYc2bAQA_4YEF3wlHKpAE_onHm-FLf8IC90pQWi1l_o5ompufP_pqOry-Qy3FCkYpuwsc_st9U5y9XATKBT_FgpgiIUryzc_UdyVmCQmSXl4-sQGHXMJWnbMC-1kQWthokCcAX02SWItmrqaoEEZNcwN61bEtKRDdrU0M3G9n6dz1ekzq18N-JEvLfM0hI00CrWGDAg5sMbP_XKcZX5aOdPV5CILkb4Mr72ceMo3VWj1e6sm1wgd5hmRrXArLoFzIi0veuehMoDkRK6eTi-_DAAPJtKBrWlsJuKyB51bPKIMBo7a-uQQVaPbwQqIbCdmfrHibQSXgTQv4KQxj9nBoGqM1xSwtjIGE7MsB5-RWaIjHOafqBuuoJa8Fi1k3z54Q_O6ggOtcme3zq9Tpiq8w9f8_VgEYPqERuVxBqciWOc0H0t3gPMwyKMxa2Y1pyC_bY_H1KrLIm2MoqXjDEMoPLMd4vlwrqhpoMN1vrNU0iIVIZTlRJbr8MRl_HSWXxH5ScH8j7wGcc_IGzTGvx_5nKy3gextjvPN079cmBSjNc6d-95ZMKJ57iLqmMIG-e2t3B3FcLeLE_GPgYg_6yaudA876XJxa_A3VDrQDIQ6ZpJ9Dca8EnOH-qbG4Eu20724TyCy8SR0DIyHiK6ECxT5Pon_CpXkBxQTjAZE6evBOkx4RmssuGQoSNXsUFOwJI5AxT2krNQc5HGrDZe8enYG9PJE11YJCZR80mX-zmcietboNTexjY-tSC4bkYEB1JcuATpnTitm7ZKivzTe5XfcFkCN1_caUXAwvrfsYTXRKRypcMJteYBtc8OXne2ka0gQOu8N1jnM6f-czrS_MwwyVsNSPFK6hfFrcrTmB4LC8ZqTqxvSw-vDrIx7vVTdQXO6FPX9aAGRdFl39o8OMbtpMKTY51sd4L8Rdb8KoxUCICVWVCr7q9SlYKZpmHtXPhSRlfw_TgSSDY5oTTflJ-cekGQQvlQl9aLd5p-OMULUC1KkUt8l_m6Ri20o0IITJm3IccxPOoLrunUp-v6tryqPwUCdNMQ0Te85MRog59sXj_Pz9f4ZqzcGAPZ9hI1GXPtStsTkQpKHciTPdiIopU0uByMcKYFkZGH--PDmfxSh-HUPXmbyMOjNCSA8lowJRMvoZ0_OrmFTyDgLoBbUwDiYH4Qrhp_HdKYXuahrRdrTrGy-N5EzVD3rnsgKzaQRjx_8BM81MiOhJ2YQWgtTW8d6Ihst9jAuHesTPIqIaUzdv-3CQdfEp0yNL92nTZPv8R0NWbQMN48JmJ7wBk25cGMOppaTvRhOELdHj8Xi-E-LB0lxfHvQsLncr1ClZg&p=1.036&aid=
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.200.231 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 231.200.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:15 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame 3942 35 B
296 B 371ms
125ms Image
image/gif 23.205.106.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=171dfec2e31c7223b199c2957e201599&algo=unicorn&bdp=0.9324&bidfp=0.1800&capd=0&cc=CA&cid=8CUBCB617&crid=188911743&ct=toronto&dc=east_sc&dfpbd=0.8205&dn=finclan.com&iwb=1&ogcbdp=0.8392&other_bids=0.83916&other_prv=203&pbshr=90.0000&prdp=0.8205&requrl=finclan.com%2F&sat=0&sc=ON&sc_pvid=203&server=1&size=160x600&strg=unicorn&totalTime=8956029&ugd=4&ver=9.6.2&cliIP=1176265102&time_stamp=2023-10-16%2014%3A48%3A08&seat=16&itype=prebid&req_id=9c7f49d21889ce6339efe34d549dc6f7&dim4=exploration&dfp_bucket=0.5&level_base=0&bdp_bucket=1.0&app_type=prod&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F118.0.5993.70%20Safari%2F537.36&br_ver=118.0.5993.70&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&model_key=generic_prebid_bsdv-_0&ogerpm=0.0000&rawbid=1.0360&totalTimeBucket=8&as_cache=0&current_day=1.0&current_hour=14&cut=12&floor_bucket=0.20&model_version=202310160905_generic_prebid_bsdv-_0&erpm_bucket=0.00&mul_ratio=0.0000&ogerpm_wd_bkt=0-1&visibility=1&viewability=0.8100&stid=div-gpt-ad-finclan_com-edge-2-0&pvid_seat=203_16&ckfl=0&mnckfl=0&sd=-1&predicted_wr=12.8532&bdp_wider_bucket=1&splid=div-gpt-ad-finclan_com-edge-2-0&dim10=false&dmm_m9=0.0000&dmm_m10=1500776&log_less=false&cut_bkt=10&advurl=chegg.com%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=3&clisp=rtb-common-56dfff94f9-hbddj.SC&dmm_m1=2023-10-16%2014%3A48%3A08.541273998&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=1600x1200&ss_d1=1600&ss_d2=1200&dmm_m22=0.0000&adtyp=0&gpid_sent=false&pst=EMS&bcrid=16243_16_377046912&buyer_id=57138582&pvag_id=3738040&erpm_mult=1.000000&zone=d&rc=1&sfm_key=3_203&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=3&wsip=mowx-5d5c748cf8-t4fvr&rel_cut_bkt=15
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.147 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-205-106-147.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3942 42 B
63 B 121ms
114ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AgM7v2P2wP3o3UWVbeE_xAGUVwb5R9cZVOX-uP05WOn_vw_sx6zxOpQGXCMTFodMlxqI2a-42js1_dyTiZMyCTwPm-_I1A8lYCdVVSAhHyyUwhgXY

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3942 0
20 B 120ms
114ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2420851283490240074&x=38&ct=76

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 release-20230927-130-adperformance.js Show response
warp.media.net/rtb/resources/ Frame DF3C 72 KB
25 KB 260ms
64ms Script
application/javascript 23.195.76.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20230927-130-adperformance.js

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.195.76.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1dbd18c0aa6071222d773de0ac1cde277406e857cf0b9c88cbf2035480857bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Mon, 16 Oct 2023 14:48:14 GMT
x-guploader-uploadid: ADPycdswZ9QV5U1NRIWxgiqSVnXUAVzgCNWOknzajbo8VVwGJ92dwVecsqlGcROhDDqt0zX7DMsg94q71MCCuHsbTgX_IZaQheFO
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25148
server: UploadServer
etag: "1eb27acd7f471c38284a9857c37daa7f"
vary: Accept-Encoding
x-goog-hash: md5=HrJ6zX9HHDgoSphXw32qfw==, crc32c=3FtsVQ==
content-type: application/javascript
x-goog-generation: 1697195146284262
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Mon, 16 Oct 2023 15:48:14 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 81ms
76ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwicmV2ZW51ZSI6MC4wMDA4MjA5OTk5OTk5OTk5OTk5LCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDgyMDk5OTk5OTk5OTk5OTksImJpZF9mbG9vcl9wcmV2Ijo4MCwic3RhdF9zb3VyY2VfaWQiOjExMzA3LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InN0YXRfc291cmNlX2lkIiwidmFsIjoiMTEzMDcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNjI3NDk2MTI3NTUzMjIiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAuMDAwODIwOTk5OTk5OTk5OTk5OSwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA4MjA5OTk5OTk5OTk5OTk5LCJiaWRfZmxvb3JfcHJldiI6ODAsInN0YXRfc291cmNlX2lkIjoxMTMwNywiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MDYyNzQ5NjEyNzU1MzIyIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTk3NSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiZGZhNjBjZWU2ZTEwNTNmYzBjOWU2MDdjODA0N2JkMjgifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNjI3NDk2MTI3NTUzMjIiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJtZWRpYV90eXBlIiwidmFsIjoiYmFubmVyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MDYyNzQ5NjEyNzU1MzIyIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTk3NSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicHJlYmlkX3NvdXJjZSIsInZhbCI6ImNsaWVudCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 82ms
76ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DF3C 187 KB
59 KB 61ms
57ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:14 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 452ms
132ms Image
image/gif 23.205.106.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=9ed5c853-36b3-4f3e-829c-8580b167d12a&cid=8CUBCB617&crid=188911743&adunit_count=1&dn=finclan.com&requrl=https://finclan.com/&istop=true&event=client_bid_won&value=0.821&rd=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.147 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-205-106-147.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H2 200 log
hblg.media.net/ Frame DF3C 35 B
191 B 78ms
63ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELAQCAAABAAAAAgAAAAAAAAEABgAAQIABAAgAINAASDc3MzkzNTUwNDY1NV8yNjA4MzM4NjFfMTg4OTExNzQzMjAzMUAxNzFkZmVjMmUzMWM3MjIzYjE5OWMyOTU3ZTIwMTU5OZYD-n5qvHST8D8maHR0cHM6Ly9maW5jbGFuLmNvbQRDQRZmaW5jbGFuLmNvbRI4Q1VCQ0I2MTcIDjE2MHg2MDAKMC44MjEOZWFzdF9zYwxQUkVCSUQGYWRtAAAAAAAAQFRA-Jerj-diAjEAAAAAAADwvzxydGItY29tbW9uLTU2ZGZmZjk0ZjktaGJkZGouU0MCEDE2Y2JlMTdjAmQC&cpr=0.7113635293315932

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 16 Oct 2023 14:48:14 GMT

GET
H2 200 clog
hblg.media.net/ Frame DF3C 35 B
191 B 131ms
117ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=4653&logid=awlog&lper=1&itypeid=3&itype=PREBID&cc=CA&cid=8CUBCB617&reqid=9c7f49d21889ce6339efe34d549dc6f7&vid=9c7f49d21889ce6339efe34d549dc6f7&dn=finclan.com&rawDn=finclan.com&pid=8PRL4E7N3&ugd=4&fleet=common&requrl=https%3A%2F%2Ffinclan.com&cliIPType=v4&coppa_status=N&coppa_applied=N&coppa_enf=true&lmt_enf=true&dnt_enf=false&geo_source=2&sc=ON&ct=toronto&zip=m5e+1e5&pubid=pub-8CUBCB617&tgtval=pub-8CUBCB617&csip=rtb-common-56dfff94f9-hbddj.SC&dtc=east_sc&zone=d&sd=-1&ptype=23&tmax=2500&xtmax=350&gdpr=0&gsi=0&gpp_present=false&app=0&sat=0&screeninfo=1600x1200&asn=577&sckfl=0&sckfl2=0&usp_status=0&usp_enf=1&usp_string=1---&ufca=0&mspa_enforced=false&pexid=PREBID-8CUBCB617&geoll=false&is_ortb=false&s_city=Santo+Domingo+Este&commit_id=16cbe17c&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-10-13+00%3A00%3A00&pbasrc=0&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&second_call=false&ipcc=CA&is_msnnative_src=false&proxy=envoy&rtttime=241&req_tid_present=false&pvid=203&prvAccId=16&prvApiId=8CUBCB617&adj0=0.0&adj1=10.0&adj2=10.0&pst=0&crid=188911743&prspt=headerBid&prvReqId=773935504655_260833861_1889117432031&size=160x600&chnl=unicorn&bdp=0.932&bid_uuid=0e795307c99572cf87135ce22766e56c&cbdp=0.821&og_cbdp=0.839&ogbdp=1.036&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&cat=IAB12&advUrl=chegg.com&dfpBd=0.821&dsrc=-2&dp=0&dbf=1&epc=188911743&s=1&snm=SUCCESS&bId=57138582&pcrid=16_16_377046912&tpbTkn=false&pvAgId=3738040&pvAgNm=MightyHive+-+Chegg+-+US&iurl=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fad%3Fdbm_p%3DAKAmf-B5LmA-IG2LW-BXHQT-kKybO2d6-QqxZe1CJnEtZxQD7KQKLgA&exid=43&bidflr=0.180&pbidflr=0.223&opbidflr=0.223&spbf=0&viewability=81&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cbsw_cw_smpl%3D1%7Ckbb_se%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100&mnrf=0&seat=16&ortbseat=16&brsrclk=0&bidrestime=1697467688444&fpuReq=0&bfs=103&acsn=1&bcrid=16243_16_377046912&strg=unicorn&stagid=div-gpt-ad-finclan_com-edge-2-0&vls=0&mang=1&pvdTmax=294&fpusp=false&ae=false&epcexp=false&moau=false&ucrid_ver=2&omid=0&mnet_static_share=0.0&dt=O&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_page_url=finclan.com&mx_sbp=-10.0&mx_sua_cvg=0001000&mx_tid_sent=false&mx_epbc=8CUBCB617&mx_SPRIG=0&mx_bsBucket=3&mx_ssProfile=0&mx_g_uid_source_cvrg%3C%3E=pubcid%23EIDS&mx_int_dsp_id=23&mx_lr=0&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=pubcid&mx_uid_sent=0&mx_bsBucketRa=0&mx_sid=8CUBCB617&mx_SC=0&mx_lr_seg_deal=1&mx_aqcpl_crid=4&mx_nsz=1&mx_sent_seats%3C%3E=44%23%23250%23%23151%23%23354%23%23431%23%23257%23%2374%23%2376%23%2316%23%23162%23%23165%23%23386%23%232%23%23200%23%23366%23%23367%23%23148%23%23303%23%23425%23%2380%23%23306%23%23429&mx_GCID=0&mx_g_uid_cvrg%3C%3E=pubcid&mx_maq_call=false&mx_aurt=0&mx_bsBucketKtwRl=0&mx_divid=div-gpt-ad-finclan_com-edge-2-0&mx_g_uid_sent%3C%3E=pubcid&mx_tgs=160x600&mx_bsProfileRa=0&mx_IAB2=0&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=1&mx_int_agency_id=132&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=-1&mx_ssBucket=0&mx_gpid_sent=false&mx_commit_id=d326d9fd9c&mx_exp_tokens%3C%3E=Dummy%3Atest-1%23%23launchexp%3Atoken1%23%23launch-wrng-exp%3Atoken1%23%23Mcid%3Atoken_2%23%23Dummy_2%3Atest-1&mx_sent_deals%3C%3E=Mnet_Bidtellect_View%23%23mn-viant-view-d%23%23mn-viant-attmet-d%23%23mn_vanguard_yahoo_d%23%23mn-viant-ctr-d%23%23mn_rad_eng_disp%23%23+mn-adelphic-bf%23%23mn-bmw-oww-yah-d%23%23Mnet_MF_Canada%23%23mn_iponwebperf_d%23%23mn_mtk_aac_jj_disp%23%23mn-adelphic-green-d%23%23mn-joh-oww-gmp-vrz-dis%23%23mn_citi_yahoo_d%23%23mn-Stirista-d%23%23mn-Stirista-politics%23%23mn_kohls_RON_dis%23%23mn_usaa_yahoo_d&native_ver=1.1&acid=171dfec2e31c7223b199c2957e201599&rtime=124.0&wsip=mowx-5d5c748cf8-t4fvr&ltime=131.0&act=headerBid&abs=0%7C0%7Cnxblock%3D-1%7Cxtmax%3D350%7Cbrr%3D0&adtypes=0&impId=25539f4d841acfd&reftime=15000&reftype=0&dsid=div-gpt-ad-finclan_com-edge-2-0&gpid=div-gpt-ad-finclan_com-edge-2-0&mowxReqId=171dfec2e31c7223b199c2957e201599_3&req_size=160x600&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=1&adpos=1&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=1&skadidfl=0&dfpDiv=div-gpt-ad-finclan_com-edge-2-0&supplyTagId=188911743&pub_pbslot=div-gpt-ad-finclan_com-edge-2-0&mnrfc=1&viewability_vendor=MEDIA.NET+EXCHANGE&viewability_mnet=81&v_mkey=gen-vblt_prebid_test_2_1&v_mver=202310152036_gen-vblt_prebid_test_2&v_alg=gen-vblt_prebid_all&vcmplrt=-1.0&imp_tid_present=false&debug_ts=2023-10-16+14%3A48%3A08&__expireat=1697471288797&mview=1&lo_pvid=%5B203%5D&lo_dp=0&lo_bdp=0.932&lo_cbdp=0.821&actltime=222&rme=adm&utime=6186&sf=0&cpr=0.11028782022777639

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 16 Oct 2023 14:48:14 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 69ms
66ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzNTQ0MjY5ODgifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNjI3NDk2MTI3NTUzMjIiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk4OCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNTcyODA3NTU5NyJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

GET
H3 200 5728075597 Show response
go.ezodn.com/dac/ 0
574 B 60ms
57ms XHR
text/plain 2606:4700:e2::ac40:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/5728075597
Requested by: Host: finclan.com
URL: https://finclan.com/porpoiseant/banger.js?cb=195-2&bv=276&v=99&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
last-modified: Mon, 16 Oct 2023 13:42:19 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://finclan.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k9ZdF03%2BRw7ciFI2ot690EOzb6cvTjJui5Z1IDWG%2Bi%2B8P6%2F9bDQ3zzPqZgCBwhJApjCPwhucXO2hQN1N78PDczN%2FKI0TSz5vZZciArcvtk8nE0fpyfzL8mrLZD3nXoXePWkHt3acKuQIvCQ%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 81711a047d6729a0-ORD
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
62 B 71ms
68ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMC0xNiJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiI0MjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 71ms
68ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYXVjdGlvbl9lcG9jaCI6MTY5NzQ2NzY5NSwiYWRfcG9zaXRpb24iOjE5NzUsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJiaWRfZmxvb3JfaW5pdGlhbCI6NDAwLCJiaWRfZmxvb3JfcHJldiI6MTAwLCJiaWRfZmxvb3JfZmlsbGVkIjozMCwiYXVjdGlvbl9jb3VudCI6NCwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NzA4LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTd9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C8D7 0
0 120ms
119ms Fetch
image/gif 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstXcel3pxRbWNtjP0_WwgZdnZKwrOlYF5YV92zetKuKITHIpK3s5HSN_JLt36u6mTfCb5aLDtsKouVJz-EiwCybA0_pTfmX17LcJUrYBv4jh8harYpNRJgkTxcBbYV7dZ2UwT0CZhFIMh27JLkMkjqOV7u9V-7bo-nTXnvzW0ieAl6p8DkJI7DuXHIGdizuz_EMXzEvDOl6ANMf2VfQqBfj8sv6mFpig9i9wh_NHO7kaoBt_nU3KO4PFA-_LNxYdYeiIQDWfyFVQ6dCd1C0lxMfS8aJ3DdTmYRG6zM0NORqi9tTBA9HmImp90w-EGRAF5uPhLOHA-xUNOlreSSm-X_Bp6HqtZZXNP20PZqcpqEtIlsl&sai=AMfl-YS9YcDJwoW9HHLh5v4nTNfJcZan0ofeYEXN33X7z4AeRN285vBPNLNtZtpe_RDj2r-3teuQMmNk8XSPnQ6F9mNZnD8WW5Zz8lekuFIWe-cySZu1ovzDnhuSGLvjrA&sig=Cg0ArKJSzBbF6n_LCsnmEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 83B6 511 B
325 B 97ms
86ms Document
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNXpjhy_8MjqjBmUkw9TJV3iOAOs3IoR_oyJvxBN2eqgtV3AwNuRZHrsgqPrRCiQro26I4vM67VPQm1a5BKEaGbIca6417wXo73b26PMAqhovvB0mmY

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9c77b52464985c96557e8d7c3030b01e75ca95174764105a9251401f74e08d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 175
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:14 GMT
expires: Mon, 16 Oct 2023 14:48:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame ABB2 89 KB
31 KB 100ms
99ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:14 GMT

GET
H2

200

adview
adx.g.doubleclick.net/pagead/ Frame ABB2
Redirect Chain

https://ghent-gce-sc.bidswitch.net/imp/1.155/BSWhttps_A_B_Badx.g.doubleclick.net_Bpagead_Badview_Cai_RCJ8GnKE0tZdDqFbefwNYPkI6O2ALtlKCycpvX__dW7EMCNtwEQASCD__eYfYP2IiYHoA6ABzt__F7wLIAQmoAwHIA5sEqgT...
https://adx.g.doubleclick.net/pagead/adview?ai=CJ8GnKE0tZdDqFbefwNYPkI6O2ALtlKCycpvX_dW7EMCNtwEQASCD_eYfYP2IiYHoA6ABzt_F7wLIAQmoAwHIA5sEqgTjAU_Qj5QVvrHC2vM1gqej8DKbFQ2O4HvE51lNZNbZmE2uDZOwUMhAvB5gK...

0
0

388ms
161ms

Image
text/html

2607:f8b0:4004:c1d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://adx.g.doubleclick.net/pagead/adview?ai=CJ8GnKE0tZdDqFbefwNYPkI6O2ALtlKCycpvX_dW7EMCNtwEQASCD_eYfYP2IiYHoA6ABzt_F7wLIAQmoAwHIA5sEqgTjAU_Qj5QVvrHC2vM1gqej8DKbFQ2O4HvE51lNZNbZmE2uDZOwUMhAvB5gK5ApwsPaVyv7S_cNJ1sjqV3mo96ZlThD0GO9Cq3hGyWp3E6YxlcT1kZFkLs5t7migYCZuEqkA3Wx2jSV6PM4lxKNiMui2-dUxFastPt7Xnap6Ip4qS4C4U_s7tC-pdHd8eiLQ6Lr3bERY8vMO2xnoHyPzAuoffn_9rqyguP1oVaIuX6VgQcNui5g9f6ZG7NmIDrA7kBCTVGBymnicaAMVlRG9nNpadabU23bg-_LrCgMjkc9eL5Tk94KwATAvIao2gPgBAOIBdqg3Y82kgUECAMYBJIFBggbEAEYAZIFCwgiEAUYAUi98osBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZMgAeaoLqQAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcKELjERhiAj-WzAdIIFAiAYRABGF8yAooCOgKAQEi9_cE68ggZYmlkZGVyLW1lZGlhbmV0XzhDVUJDQjYxN4AKBMgLAdoMEAoKEPC6peKTosfTUhICAQOwE6nBlBXIE6zPhd4D2BMNiBQG2BQB0BUBgBcBshcICgYIABIAGAA&sigh=NhZxSacbnfE&uach_m=[UACH]&ase=2&nis=4&pr=38:1.155&cid=CAQSMgDICaaNMnmMaCtPGdQC_vwHIPH__R5hyH8WN-J3siKUjBikGiZ2MrQCO5CajtOWDgGmGAE
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Redirect headers

Location: https://adx.g.doubleclick.net/pagead/adview?ai=CJ8GnKE0tZdDqFbefwNYPkI6O2ALtlKCycpvX_dW7EMCNtwEQASCD_eYfYP2IiYHoA6ABzt_F7wLIAQmoAwHIA5sEqgTjAU_Qj5QVvrHC2vM1gqej8DKbFQ2O4HvE51lNZNbZmE2uDZOwUMhAvB5gK5ApwsPaVyv7S_cNJ1sjqV3mo96ZlThD0GO9Cq3hGyWp3E6YxlcT1kZFkLs5t7migYCZuEqkA3Wx2jSV6PM4lxKNiMui2-dUxFastPt7Xnap6Ip4qS4C4U_s7tC-pdHd8eiLQ6Lr3bERY8vMO2xnoHyPzAuoffn_9rqyguP1oVaIuX6VgQcNui5g9f6ZG7NmIDrA7kBCTVGBymnicaAMVlRG9nNpadabU23bg-_LrCgMjkc9eL5Tk94KwATAvIao2gPgBAOIBdqg3Y82kgUECAMYBJIFBggbEAEYAZIFCwgiEAUYAUi98osBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZMgAeaoLqQAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcKELjERhiAj-WzAdIIFAiAYRABGF8yAooCOgKAQEi9_cE68ggZYmlkZGVyLW1lZGlhbmV0XzhDVUJDQjYxN4AKBMgLAdoMEAoKEPC6peKTosfTUhICAQOwE6nBlBXIE6zPhd4D2BMNiBQG2BQB0BUBgBcBshcICgYIABIAGAA&sigh=NhZxSacbnfE&uach_m=[UACH]&ase=2&nis=4&pr=38:1.155&cid=CAQSMgDICaaNMnmMaCtPGdQC_vwHIPH__R5hyH8WN-J3siKUjBikGiZ2MrQCO5CajtOWDgGmGAE
Date: Mon, 16 Oct 2023 14:48:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2

200

cksync.php
contextual.media.net/ Frame ABB2
Redirect Chain

https://us-east-sync.bidswitch.net/sync?ssp=medianet&dsp_id=16&imp=1
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=medianet&bsw_param=a77dcf3e-0a02-43b0-ba25-509c697b290e&google_hm=YTc3ZGNmM2UtMGEwMi00M2IwLWJhMjUtNTA5YzY5N2IyOTBl
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEIeGoPUo8_1vJug6elqoawQ&google_cver=1&ssp=medianet&bsw_param=a77dcf3e-0a02-43b0-ba25-509c697b290e
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=

53 B
463 B

218ms
217ms

Image
image/gif

23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-195-76-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:15 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 16 Oct 2023 14:48:15 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&gdpr_pd=
Date: Mon, 16 Oct 2023 14:48:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK medianet_bid
ghent-gce-sc.bidswitch.net/win_notice/ Frame ABB2 43 B
183 B 388ms
132ms Image
image/gif 35.211.200.231
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ghent-gce-sc.bidswitch.net/win_notice/medianet_bid?rid=kmOZ816CI9IRLj1Wz63tlmTAlo3j8gWaKQmGPV1W2uXhNUDLMtfjnjUkvisYdXPmXJuOv3mw1kfjb4XRnSYtScTI-inn_Dqu_FPe3WDi0o80XGjVAfP8aEyRfmRynDKeJjuMLxzVLe0MhA05y8vZTNn1gI3grIfctScaYthCqWU4-fEotR1_tuUh8ihu2RuQsmiHb9xXVNHFX36nyWEYO3-W3yRjujYRUVfR1Rux7Wc4Ypl_fmeUYKwBudrkzBOuNvMBWY5pLWitwkOKNH9v51Heb_8jvlI3YTfw6cOtcaWON0ynsSIVmYZMSLrozE6klTJ0frYx6W1yB67XqhqxoCrIbqelmm-IebHvz9XtT9JpiL886xoqo1d32Ljsttcc41vtCqC3lH1D9oq0aeP1g8216pciK-iz76wY_CcqWOKDgjXhqShp898C1HogptItr628teww7diuJl9WWDAllKtwZGA7twcsVWOvJ8nQFsOwPA5eJoVMHrD8N-oW5ZLGrLoU2Ejh6AUSLYe1-Xx7NRlY_4ZQoVF8D9RmvfEaPfcgl9fu5r4U4o67X4HLccFCAGVqH4HYPf4ke8I45Bxgk1VG12Akz76AI1QTop--rFk_OfAyX9L5ESlIa_gkU3q20lUaEEcHl9rGBXv-xmnNAuaaDcOFJby0kPArz0C4EhY_zILVTcPnuAT2U59XHJvIDHNc2Nv7qpOTbZgQGkDuOuSWd_dQj0_g2_UbHnXPluDh5RZ5d_Q1-ibYMuACYf4Rn0EejR_Qv6vF59TJFLp4KauiEIzKIZeSAy2Ds_NdBQftorDVtpbfD-raSVMuhh2TQ_gLNr-ogCGsV-Ps8En8zLJR1ySr69fMyP9-zoJEpkGF8SHn-u_mCCwxLp3RLpmcFRd4nBv5_u2bbyolWQSqodIl5-SfLG5pRiOKhzWlZPu9Nkf1k9Lk33pEjn3x6fvXKTGQbCI_skbWHJNzuw6f2DJR5sG4iG9TGVL5bqb1er8AwtZa72wL2uwL9BmTJNCqAa1v13JmhnABZteMEO_ItnQQPknpxYvmBV5ogYVMIDFMERE-zbDteuqe_Vvmn65rm6JnPOJUO3sFR6XDZ1OKFxmYP5q4iyD-W3W7bRsIcW6IQzy2D-0n-_NZ-dT-NyHknaGk2ULZKSmuDYDi8ktcYiJM6YmKgMEimUaMddcq2sCLwAxVl6SSVa7yW6RjoPtvlPbOGALPdjfRtQL7ODW3Mm-DNxKEME9oe3iObbMwpKSot5V2VSBk2m5uWe6_CNOoy5s43xZGTbfBXoMoOHMBc8jvrnhATFnkcXRg1U7kzqkkC0YVe8qVDIv8sEQJkeF8l0FtbXrj4liOlNNAA36LxNZt6XUnT5T31XfsH4XXU8tboICPkVMRhYG1-qnQO9YhkZFV4Gwcvxf1Be0Hsw9g-sTMkvaWzhgYZnzriVUXmiTK6FoFYqCMKWyNLumFpPYtMMGaeCCUSZlB4dU63Pdzf7zPK1VwLnP6hJszv6qiuVCBAIwzVp5qE7-LRZ6sYkFyTbis_NPe0AzwqndKOvGij1Qom17CUUEPLiHATVCB3EtkicyfCCrkTq87ls42Wzl3O9Uos2wCM6Cnb5I&p=1.155&aid=
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.200.231 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 231.200.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:15 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame ABB2 35 B
296 B 297ms
133ms Image
image/gif 23.205.106.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=0e182da61ca592a2ef8430e129226b1c&algo=unicorn&bdp=1.0395&bidfp=0.1800&capd=0&cc=CA&cid=8CUBCB617&crid=188911743&ct=toronto&dc=east_sc&dfpbd=0.9148&dn=finclan.com&iwb=1&ogcbdp=0.9355&other_bids=0.93555&other_prv=203&pbshr=90.0000&prdp=0.9148&requrl=finclan.com%2F&sat=0&sc=ON&sc_pvid=203&server=1&size=728x90&strg=unicorn&totalTime=3317490&ugd=4&ver=9.6.2&cliIP=1176265102&time_stamp=2023-10-16%2014%3A48%3A08&seat=16&itype=prebid&req_id=9c7f49d21889ce6339efe34d549dc6f7&dim4=exploration&dfp_bucket=0.5&level_base=0&bdp_bucket=1.0&app_type=prod&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F118.0.5993.70%20Safari%2F537.36&br_ver=118.0.5993.70&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&model_key=generic_prebid_bsdv-_0&ogerpm=0.0000&rawbid=1.1550&totalTimeBucket=3&as_cache=0&current_day=1.0&current_hour=14&cut=12&floor_bucket=0.20&model_version=202310160905_generic_prebid_bsdv-_0&erpm_bucket=0.00&mul_ratio=0.0000&ogerpm_wd_bkt=1-2&visibility=1&viewability=0.8100&stid=div-gpt-ad-finclan_com-medrectangle-2-0&pvid_seat=203_16&ckfl=0&mnckfl=0&sd=-1&predicted_wr=12.5132&bdp_wider_bucket=2&splid=div-gpt-ad-finclan_com-medrectangle-2-0&dim10=false&dmm_m9=0.0000&dmm_m10=1082307&log_less=false&cut_bkt=10&advurl=chegg.com%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=3&clisp=rtb-common-56dfff94f9-hbddj.SC&dmm_m1=2023-10-16%2014%3A48%3A08.536078811&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=1600x1200&ss_d1=1600&ss_d2=1200&dmm_m22=0.0000&adtyp=0&gpid_sent=false&pst=EMS&bcrid=16243_16_377046912&buyer_id=57138582&pvag_id=3738040&erpm_mult=1.000000&zone=d&rc=1&sfm_key=3_203&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=3&wsip=mowx-5d5c748cf8-fcfc2&rel_cut_bkt=15
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.147 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-205-106-147.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABB2 42 B
63 B 135ms
128ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ABfiELB7Obl9HnPrERGaOX3bIlpPUmGKucW_FA5yjYsxkdstcv5qRviXrydYlppy13hE8Ap_V5U9YUUjJrmsxxRuStddWtRkGgYxJKsRaNqRBl_SY

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABB2 0
20 B 135ms
128ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2420274292756573468&x=38&ct=76

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 release-20230927-130-adperformance.js Show response
warp.media.net/rtb/resources/ Frame C8D7 72 KB
25 KB 246ms
88ms Script
application/javascript 23.195.76.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20230927-130-adperformance.js

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-2-67

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.195.76.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1dbd18c0aa6071222d773de0ac1cde277406e857cf0b9c88cbf2035480857bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Mon, 16 Oct 2023 14:48:14 GMT
x-guploader-uploadid: ADPycdswZ9QV5U1NRIWxgiqSVnXUAVzgCNWOknzajbo8VVwGJ92dwVecsqlGcROhDDqt0zX7DMsg94q71MCCuHsbTgX_IZaQheFO
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25148
server: UploadServer
etag: "1eb27acd7f471c38284a9857c37daa7f"
vary: Accept-Encoding
x-goog-hash: md5=HrJ6zX9HHDgoSphXw32qfw==, crc32c=3FtsVQ==
content-type: application/javascript
x-goog-generation: 1697195146284262
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Mon, 16 Oct 2023 15:48:14 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 114ms
106ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJyZXZlbnVlIjowLjAwMDkxNSwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA5MTUsImJpZF9mbG9vcl9wcmV2Ijo5MCwic3RhdF9zb3VyY2VfaWQiOjExMzA3LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InN0YXRfc291cmNlX2lkIiwidmFsIjoiMTEzMDcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijg4MzExMjI5ODQ4MTI3MTYiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwicmV2ZW51ZSI6MC4wMDA5MTUsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwOTE1LCJiaWRfZmxvb3JfcHJldiI6OTAsInN0YXRfc291cmNlX2lkIjoxMTMwNywiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4ODMxMTIyOTg0ODEyNzE2IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJiMzU1ZTkyMjdiNTUxYzExOWEzMGE2ODg1MjcyM2I2MiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibWVkaWFfdHlwZSIsInZhbCI6ImJhbm5lciJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicHJlYmlkX3NvdXJjZSIsInZhbCI6ImNsaWVudCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 111ms
105ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C8D7 187 KB
59 KB 73ms
67ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:14 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 66ms
65ms Image
image/gif 23.205.106.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=9ed5c853-36b3-4f3e-829c-8580b167d12a&cid=8CUBCB617&crid=188911743&adunit_count=1&dn=finclan.com&requrl=https://finclan.com/&istop=true&event=client_bid_won&value=0.915&rd=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.147 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-205-106-147.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H2 200 log
hblg.media.net/ Frame C8D7 35 B
191 B 62ms
61ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELAQCAAABAAAAAgAAAAAAAAEABgAAQIABAAgAINAATDE2NDA1NjkzNDQ3MzM1XzY5NTQ2ODIxMV8xODg5MTE3NDMyMDMxQDBlMTgyZGE2MWNhNTkyYTJlZjg0MzBlMTI5MjI2YjFjlgN7FK5H4XryPyZodHRwczovL2ZpbmNsYW4uY29tBENBFmZpbmNsYW4uY29tEjhDVUJDQjYxNwgMNzI4eDkwCjAuOTE1DmVhc3Rfc2MMUFJFQklEBmFkbQAAAAAAAEBUQKiYq4_nYgIxAAAAAAAA8L88cnRiLWNvbW1vbi01NmRmZmY5NGY5LWhiZGRqLlNDAhAxNmNiZTE3YwJkAg&cpr=0.883146763084572

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H2 200 clog
hblg.media.net/ Frame C8D7 35 B
191 B 113ms
112ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=4716&logid=awlog&lper=1&itypeid=3&itype=PREBID&cc=CA&cid=8CUBCB617&reqid=9c7f49d21889ce6339efe34d549dc6f7&vid=9c7f49d21889ce6339efe34d549dc6f7&dn=finclan.com&rawDn=finclan.com&pid=8PRL4E7N3&ugd=4&fleet=common&requrl=https%3A%2F%2Ffinclan.com&cliIPType=v4&coppa_status=N&coppa_applied=N&coppa_enf=true&lmt_enf=true&dnt_enf=false&geo_source=2&sc=ON&ct=toronto&zip=m5e+1e5&pubid=pub-8CUBCB617&tgtval=pub-8CUBCB617&csip=rtb-common-56dfff94f9-hbddj.SC&dtc=east_sc&zone=d&sd=-1&ptype=23&tmax=2500&xtmax=350&gdpr=0&gsi=0&gpp_present=false&app=0&sat=0&screeninfo=1600x1200&asn=577&sckfl=0&sckfl2=0&usp_status=0&usp_enf=1&usp_string=1---&ufca=0&mspa_enforced=false&pexid=PREBID-8CUBCB617&geoll=false&is_ortb=false&s_city=Santo+Domingo+Este&commit_id=16cbe17c&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-10-13+00%3A00%3A00&pbasrc=0&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&second_call=false&ipcc=CA&is_msnnative_src=false&proxy=envoy&rtttime=240&req_tid_present=false&pvid=203&prvAccId=16&prvApiId=8CUBCB617&adj0=0.0&adj1=10.0&adj2=10.0&pst=0&crid=188911743&prspt=headerBid&prvReqId=16405693447335_695468211_1889117432031&size=728x90&chnl=unicorn&bdp=1.040&bid_uuid=f90e3a1fdc1ff4cb3018ed403c70db5f&cbdp=0.915&og_cbdp=0.936&ogbdp=1.155&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&cat=IAB12&advUrl=chegg.com&dfpBd=0.915&dsrc=-2&dp=0&dbf=1&epc=188911743&s=1&snm=SUCCESS&bId=57138582&pcrid=16_16_377046912&tpbTkn=false&pvAgId=3738040&pvAgNm=MightyHive+-+Chegg+-+US&iurl=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fad%3Fdbm_p%3DAKAmf-B5LmA-IG2LW-BXHQT-kKybO2d6-QqxZe1CJnEtZxQD7KQKLgA&exid=43&bidflr=0.180&pbidflr=0.223&opbidflr=0.223&spbf=0&viewability=81&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cbsw_cw_smpl%3D1%7Ckbb_se%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100&mnrf=0&seat=16&ortbseat=16&brsrclk=0&bidrestime=1697467688468&fpuReq=0&bfs=103&acsn=1&bcrid=16243_16_377046912&strg=unicorn&stagid=div-gpt-ad-finclan_com-medrectangle-2-0&vls=0&mang=1&pvdTmax=294&fpusp=false&ae=false&epcexp=false&moau=false&ucrid_ver=2&omid=0&mnet_static_share=0.0&dt=O&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_page_url=finclan.com&mx_sbp=-10.0&mx_sua_cvg=0001000&mx_tid_sent=false&mx_epbc=8CUBCB617&mx_SPRIG=0&mx_bsBucket=3&mx_ssProfile=0&mx_g_uid_source_cvrg%3C%3E=pubcid%23EIDS&mx_int_dsp_id=23&mx_lr=0&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=pubcid&mx_uid_sent=0&mx_bsBucketRa=0&mx_sid=8CUBCB617&mx_SC=0&mx_lr_seg_deal=1&mx_aqcpl_crid=4&mx_nsz=2&mx_sent_seats%3C%3E=44%23%23250%23%23151%23%23354%23%23431%23%23257%23%2374%23%2376%23%2316%23%23162%23%23165%23%23386%23%232%23%23200%23%23366%23%23367%23%23148%23%23303%23%23425%23%2380%23%23306%23%23429&mx_GCID=0&mx_g_uid_cvrg%3C%3E=pubcid&mx_maq_call=false&mx_aurt=0&mx_bsBucketKtwRl=0&mx_divid=div-gpt-ad-finclan_com-medrectangle-2-0&mx_g_uid_sent%3C%3E=pubcid&mx_tgs=728x90%7C970x90&mx_bsProfileRa=0&mx_IAB2=0&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=1&mx_int_agency_id=132&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=-1&mx_ssBucket=0&mx_gpid_sent=false&mx_commit_id=d326d9fd9c&mx_exp_tokens%3C%3E=launch-wrng-exp%3Atoken2%23%23launchexp%3Atoken1%23%23Dummy_2%3Atest-1%23%23Mcid%3ADEFAULT%23%23Dummy%3Atest2&mx_sent_deals%3C%3E=Mnet_Bidtellect_View%23%23mn-viant-view-d%23%23mn-viant-attmet-d%23%23mn_vanguard_yahoo_d%23%23mn-viant-ctr-d%23%23mn_rad_eng_disp%23%23+mn-adelphic-bf%23%23mn-bmw-oww-yah-d%23%23Mnet_MF_Canada%23%23mn_iponwebperf_d%23%23mn_mtk_aac_jj_disp%23%23mn-adelphic-green-d%23%23mn-joh-oww-gmp-vrz-dis%23%23mn_citi_yahoo_d%23%23mn-Stirista-d%23%23mn-Stirista-politics%23%23mn_kohls_RON_dis%23%23mn_usaa_yahoo_d&native_ver=1.1&acid=0e182da61ca592a2ef8430e129226b1c&rtime=127.0&wsip=mowx-5d5c748cf8-fcfc2&ltime=155.0&act=headerBid&abs=0%7C0%7Cnxblock%3D-1%7Cxtmax%3D350%7Cbrr%3D0&adtypes=0&impId=2417541986e47d6&reftime=15000&reftype=0&dsid=div-gpt-ad-finclan_com-medrectangle-2-0&gpid=div-gpt-ad-finclan_com-medrectangle-2-0&mowxReqId=0e182da61ca592a2ef8430e129226b1c_3&req_size=970x90%7C728x90&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=1&adpos=1&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=1&skadidfl=0&dfpDiv=div-gpt-ad-finclan_com-medrectangle-2-0&supplyTagId=188911743&pub_pbslot=div-gpt-ad-finclan_com-medrectangle-2-0&mnrfc=1&viewability_vendor=MEDIA.NET+EXCHANGE&viewability_mnet=81&v_mkey=gen-vblt_prebid_test_2_1&v_mver=202310152036_gen-vblt_prebid_test_2&v_alg=gen-vblt_prebid_all&vcmplrt=-1.0&imp_tid_present=false&debug_ts=2023-10-16+14%3A48%3A08&__expireat=1697471288796&mview=1&lo_pvid=%5B203%5D&lo_dp=0&lo_bdp=1.040&lo_cbdp=0.915&actltime=222&rme=adm&utime=6230&sf=0&cpr=0.5625446148799136

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 16 Oct 2023 14:48:15 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 103ms
101ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5NjcsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODM1NDQyNjk2NyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5NjcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjU3MjgwNzU1OTcifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

GET
H3 200 5728075597 Show response
go.ezodn.com/dac/ 0
571 B 60ms
58ms XHR
text/plain 2606:4700:e2::ac40:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/5728075597
Requested by: Host: finclan.com
URL: https://finclan.com/porpoiseant/banger.js?cb=195-2&bv=276&v=99&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
last-modified: Mon, 16 Oct 2023 13:42:19 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://finclan.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnPfIk3cTf3IPqpfK2JizWUGccTa%2FKO8WoaOlUn9oW7pL38RvYTvWLvJBFRqge70T7s2OiQkRvMn%2BdZSyWk8NTtgwZN0hUK1cXqeHlZpJgfQzXyTuGe4Q%2BftfgYnx2t9fKlF63eKeEDjoNw%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 81711a04bda229a0-ORD
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 103ms
100ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5NjcsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIzLTEwLTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjQyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 101ms
99ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhdWN0aW9uX2Vwb2NoIjoxNjk3NDY3Njk1LCJhZF9wb3NpdGlvbiI6MTEwMCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImJpZF9mbG9vcl9pbml0aWFsIjozNTAsImJpZF9mbG9vcl9wcmV2IjoxMDAsImJpZF9mbG9vcl9maWxsZWQiOjQyLCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo3MTAsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5N31d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F0A0 581 B
411 B 132ms
129ms Document
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEYzZOV1AEwAQ&v=APEucNW8WrwqKTFHgAdO6XueZKtd3E47La3qZUvLSwk_UOJij1j8t6N_0LvIWfCsUN8MkCP1rX1wW1Bt3C3ngC6A5JVPhFSXaVbfqLiFzb3ydD3muvGFbSQ

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1aca13a5b24687b2213a2a9d87cbd7f140a6eb4d4db480d4867a81a433813b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 262
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:14 GMT
expires: Mon, 16 Oct 2023 14:48:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 494A 89 KB
31 KB 133ms
130ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:14 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 494A 2 KB
1 KB 324ms
119ms Script
application/javascript 2600:1408:7::170f:92b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=11556288&cmp=28644182&plc=347433751&sid=2742014&aufilter1=3007433&prr=1&ppid=103&autt=1&auevent=ABAjH0jgNYxuqeKi8CF6c3SJkD9g&c1=3007433&auorder=1009120791&aucmp=18464393000&aucrtv=444942797&auxch=38&pltfrm=38&ausite=610283236078&turl=https://finclan.com/&aubndl=&dvregion=0&unit=160x600
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:7::170f:92b Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 5aceb9edcea34bb69cbce4ff713f96f5d62f70bbd4bf5ef766bf058bed0fa21c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Oct 2023 09:51:44 GMT
Server: UploadServer
ETag: "56f95dec40f6402642b5537aa29ad91c"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 932
Expires: Tue, 17 Oct 2023 14:48:15 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 494A 9 KB
4 KB 330ms
112ms Script
application/javascript 2600:1408:7::170f:92b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:7::170f:92b Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 792654aa4a1221dd02c6054199c84e884117d0b9df4f06645b9dcd4b6febb832

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 07:38:55 GMT
Server: UploadServer
ETag: "36c0de7f4d9395483b145b49e40f882e"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3640
Expires: Mon, 16 Oct 2023 15:03:15 GMT

GET
H2

200

adview
adx.g.doubleclick.net/pagead/ Frame 494A
Redirect Chain

https://ghent-gce-sc.bidswitch.net/imp/1.0231560000000002/BSWhttps_A_B_Badx.g.doubleclick.net_Bpagead_Badview_Cai_RCLerSKE0tZaS-GfGB6toPho6RgAi3qIjGc4644cS1EGQQASCD__eYfYP2IiYHoA6ABl5uykwPIAQmpAnym...
https://adx.g.doubleclick.net/pagead/adview?ai=CLerSKE0tZaS-GfGB6toPho6RgAi3qIjGc4644cS1EGQQASCD_eYfYP2IiYHoA6ABl5uykwPIAQmpAnymyDzWmag-qAMByAObBKoE8gFP0IYYUuACONsehBXgRTAjP_2qdRJ7R3HIBtinjk-9PzT7x...

0
0

284ms
161ms

Image
text/html

2607:f8b0:4004:c1d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://adx.g.doubleclick.net/pagead/adview?ai=CLerSKE0tZaS-GfGB6toPho6RgAi3qIjGc4644cS1EGQQASCD_eYfYP2IiYHoA6ABl5uykwPIAQmpAnymyDzWmag-qAMByAObBKoE8gFP0IYYUuACONsehBXgRTAjP_2qdRJ7R3HIBtinjk-9PzT7xa--1gy9-FQOyz0ysWIiLgQSTmFnv2jvr-44zJWE_R37JEc7qunc3EYnPTW5lIm9Fh9-S7Pek3PS72iHXu8UgkaGD6BoLPmvbiRsYDfL0eFGSiy9YogF-rlv9ULiYWR_lbtj6aLReBUqgLFJwtrZ_TF9I3rx0k0WdO3H3-GS4IKnjl54SKNoYLax8WFljZE2F1TmsCcCtnUbg7DBWXo-YdrfF9TnplJIJaDBNLtI_hbpjoo1OX2U63rE2gH-Q7TmvBdLTWl2fNN5U3HsPz9p_sAEx7-T2Y0E4AQDiAWojsHkRJIFBggDEAEYAZIFBggbEAEYA5IFCggiEAEYAUj_oimSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBkyAB9HkzWyoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChCSsUAYzZOV1AHSCBQIgGEQARhfMgKKAjoCgEBIvf3BOvIIFmJpZGRlci1vbmV0YWdfMjI2NDkzMTCACgTICwHaDBEKCxDQg7Hu-e6QorEBEgIBA7AT0ZaVFcgTl-yX4QPYEwqIFAzYFAHQFQGAFwGyFwgKBggAEgAYAOgXBA&sigh=ZZWNkwo0CiI&uach_m=[UACH]&ase=2&nis=4&pr=38:1.02315&cid=CAQSMgDICaaNKyGpapAQJo_L7HIEdPH07AAs5H9N8p4OGTu2TXrZNT9H-nNoVbPK5FAzSpOSGAE
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Redirect headers

Location: https://adx.g.doubleclick.net/pagead/adview?ai=CLerSKE0tZaS-GfGB6toPho6RgAi3qIjGc4644cS1EGQQASCD_eYfYP2IiYHoA6ABl5uykwPIAQmpAnymyDzWmag-qAMByAObBKoE8gFP0IYYUuACONsehBXgRTAjP_2qdRJ7R3HIBtinjk-9PzT7xa--1gy9-FQOyz0ysWIiLgQSTmFnv2jvr-44zJWE_R37JEc7qunc3EYnPTW5lIm9Fh9-S7Pek3PS72iHXu8UgkaGD6BoLPmvbiRsYDfL0eFGSiy9YogF-rlv9ULiYWR_lbtj6aLReBUqgLFJwtrZ_TF9I3rx0k0WdO3H3-GS4IKnjl54SKNoYLax8WFljZE2F1TmsCcCtnUbg7DBWXo-YdrfF9TnplJIJaDBNLtI_hbpjoo1OX2U63rE2gH-Q7TmvBdLTWl2fNN5U3HsPz9p_sAEx7-T2Y0E4AQDiAWojsHkRJIFBggDEAEYAZIFBggbEAEYA5IFCggiEAEYAUj_oimSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBkyAB9HkzWyoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChCSsUAYzZOV1AHSCBQIgGEQARhfMgKKAjoCgEBIvf3BOvIIFmJpZGRlci1vbmV0YWdfMjI2NDkzMTCACgTICwHaDBEKCxDQg7Hu-e6QorEBEgIBA7AT0ZaVFcgTl-yX4QPYEwqIFAzYFAHQFQGAFwGyFwgKBggAEgAYAOgXBA&sigh=ZZWNkwo0CiI&uach_m=[UACH]&ase=2&nis=4&pr=38:1.02315&cid=CAQSMgDICaaNKyGpapAQJo_L7HIEdPH07AAs5H9N8p4OGTu2TXrZNT9H-nNoVbPK5FAzSpOSGAE
Date: Mon, 16 Oct 2023 14:48:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2

200

sync
partners.tremorhub.com/ Frame 494A
Redirect Chain

https://us-east-sync.bidswitch.net/sync?ssp=onetag&dsp_id=16&imp=1
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dtremor
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dtremor
https://x.bidswitch.net/sync?dsp_id=59&user_id=e79ce39c-f43a-4ee3-b046-72552f793c24&ssp=tremor
https://partners.tremorhub.com/sync?UIBS=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&us_privacy=

43 B
174 B

69ms
69ms

Image
image/gif

2600:1f18:612b:4264:936e:bcf9:b85:4d88
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIBS=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Server: 2600:1f18:612b:4264:936e:bcf9:b85:4d88 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Mon, 16 Oct 2023 14:48:16 GMT
server: nginx
content-type: image/gif

Redirect headers

Location: //partners.tremorhub.com/sync?UIBS=a77dcf3e-0a02-43b0-ba25-509c697b290e&gdpr=&gdpr_consent=&us_privacy=
Date: Mon, 16 Oct 2023 14:48:16 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 494A 42 B
63 B 115ms
113ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bry-PJNc4PO9zQOLZMdBYRMOji5a8JkMif-TRS8h2Vb9RflQ9oisyFCOZ9unHntafJ74JK7UP2fSqe5PXcd8HqGi7IrYRumSxnkalUYv4h6WzWIxs

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 494A 0
20 B 114ms
112ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16187705444291276706&x=38&ct=76

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
onetag-sys.com/analytics/ Frame 8215 0
178 B 56ms
54ms XHR
text/plain 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/analytics/

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.23

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://finclan.com
strict-transport-security: max-age=15552000
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin, Referer, User-Agent, x-ak-clientip
content-length: 0

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame CFBE 3 KB
1 KB 53ms
53ms Document
text/html 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&us_privacy=1---

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

5449badded02a2b18bfecb2cffd65db4d00fd7393b0baf809818de11cee4e3d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1068
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
DATA 200
OK truncated
/ Frame 8215 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 76d6dd39f01d4ac4812fee0b376fa66de26a32d8086338366aafe3e45434ffc5

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

cs
cs.lkqd.net/ Frame 137C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm&gdpr=0
https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEH_6UfQ6cpm_8oVn_Qd-HII&gdpr=0&google_cver=1

43 B
535 B

162ms
109ms

Image
image/gif

69.20.43.192
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEH_6UfQ6cpm_8oVn_Qd-HII&gdpr=0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNWGBA55k-qbdvFfuRTU92sF2s507lIPk6xph8FjBC2Kk1FOoO9mwNk4dDQlG0Va6U0OnfCHh1n0V-JGNzUs3XgAQuomKywu7xB8yHlVSBjKH7LzdRc
Protocol: H2
Server: 69.20.43.192 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEH_6UfQ6cpm_8oVn_Qd-HII&gdpr=0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 307
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 137C
Redirect Chain

https://cs.lkqd.net/cs?partnerId=59&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dlkqd_dbm%26google_hm%3D%24%24rawlkqduserid%7Cbase64%24%24
https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_hm=ZWJ0eEJPUmZJNUE

170 B
188 B

71ms
70ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_hm=ZWJ0eEJPUmZJNUE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNWGBA55k-qbdvFfuRTU92sF2s507lIPk6xph8FjBC2Kk1FOoO9mwNk4dDQlG0Va6U0OnfCHh1n0V-JGNzUs3XgAQuomKywu7xB8yHlVSBjKH7LzdRc

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 16 Oct 2023 14:48:15 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_hm=ZWJ0eEJPUmZJNUE
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 137C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&gdpr=0

43 B
735 B

73ms
72ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNWGBA55k-qbdvFfuRTU92sF2s507lIPk6xph8FjBC2Kk1FOoO9mwNk4dDQlG0Va6U0OnfCHh1n0V-JGNzUs3XgAQuomKywu7xB8yHlVSBjKH7LzdRc
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0WfLYI7MAF%2Bb0e9GGntAfcxTzZ%2FwjqYaDhxGfJ1hYlFkpQxeOTTEIfTlqj1%2BuJz5VMcSYae7IEdhPfroQJWdq2xiECj2qO2lGIT9FlOJtuNbktAFnVCfx8E%2Fa6NP01oeLLLW1Zf%2BEPHwww%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81711a061be1a22e-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 137C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZS1NLM4NBN0.v9ejan-EtAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&google_hm=2

43 B
730 B

80ms
80ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNWGBA55k-qbdvFfuRTU92sF2s507lIPk6xph8FjBC2Kk1FOoO9mwNk4dDQlG0Va6U0OnfCHh1n0V-JGNzUs3XgAQuomKywu7xB8yHlVSBjKH7LzdRc
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SX1GqIomVWkrpECfgMHUg%2FV5yov5otvqBHP41HTj79UcLn1EV5WcLG0KT1viZRz9wNY0wj67J56ds0QOqYyCgZppNMvcDdi7uNG567cSviDpM1rvveTKGPgTAbdw%2FuxEO3eOM2nmrfGgiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81711a069ca1a22e-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEaExpAISu2y5JduDy8ugTw&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
291 B 60ms
59ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.12/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://finclan.com
Date: Mon, 16 Oct 2023 14:48:14 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3942 0
20 B 113ms
112ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=749714918270&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3942 0
20 B 114ms
113ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=749714918270&version=m202309260101&ct=76&x=38&cor=2420851283490240000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3942 92 KB
38 KB 119ms
118ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DfOPWsGmLEVAcUKMHDbGEt1hazV4eZp2u-2YWYgeBbAjFW0_Ovw2981EujTrbiO-CwwoQ7_kTZqbXfIEaZPs-jhE5CQzHtnQt0SmD3h4Td1Tnsxp7b5ThrsL67DgZHZh4F9pC8CoqbFwDM9UT8hDbXv-WmCEdaESUi1Js4uWsdqcGNh8c&dbm_d=AKAmf-DDiXli7DymPQ5ZE40FNAaey7LZQ3wY6pcuo0Kwpg0GXlArTNz57OgCjzXXhAEZIWLCqe2Vb_xlA2SNX-FQvkhf0pa00y4TBqjCYpN-TCUFl-9iS7PjzFESgjq_929U885J-VVJFTM_EXiJOPZHEiygHaQAVw8hXxtsCKnJaBDes72rA8L4Ni7mQJmojECCk3_ijwnfpKGf43lqJ9M1nqhx_Dh7xJvdyO7UefS4_QeRY0GBGRSkJY66cj5rtAFm-eFLSP0JrTU6TOm0GZBEBhr-wFrxki16Nph5UYMVxg2C-iU7DIQJRtuFC-Lo9YTXdgWwQZ0A__imOwLG9cFxWqvf_neuNmuQvBBwrCf-X5uMUtJ4Er26HYo9n3Q5qLmQciGLRHNaq1d72kdUQvub6IwNx0WviDP6gxhd6U-KbyvJgUT7ewrHOxypHTcZlwE3jkkeU_kbJ4BFmeIxHQ3pXSb0wChrQ0c9qeUPHQ8_29hxBuTLq_iq5MucPmoiLJAdJ6pxWfTQGYmMku8FDe6vXka9WP8xWigbAbSGLw9OjYJJXppYRPiIbbeLjp-cxTDGBNQnpvzGRCLStCMY1JLXu-w0UJMgoq4VJyE6r8VtDcZylCa8nAz4IGHgB2bmnlXBMhF7JswXlEEo-N1kE1dCKMOy-ZAH5r6oXV-Mg-1-fwFPGfbfgAU_F5z2l0V6LMuF7WLKFo7hfJBc2KOqoht-LeOPDaezbM6V7ALvJLd6-7yRyRkOFfXKjpi0KNrarXFAlUqsQE0g-hYe1qwEGjC06262nraQ0dsj6vbZHdvUbGX1lqKWR2I7OYbI1EyA3eJv6MPhfUOW1Lrj-MCLdBXN-45eorq1hn4UHIre6hif_fGqZNfv-_Uq1BAPZU3acJCz2gmDiPLza_VTjb5ep0mCrv7-eyNEJwOBCHDKBmGpiOIcnuKPUOwXXsJQ0LPnUebXhLtRbYYruRdghtsev_2osFiww-RvqgzYIQCUnrdvqBA4nWvDfyYqVlWZK25UYM5sP9Xb6jUrPt_kVjzX9vqrPQ-m_dnqzJ4pmNwgi7ZpDtYzDobj2Yh9aPv8M4G9gwel5lUfWheUooJ89IjPX3BiHPzRaBp1HwuIMobkR8wF20rarRH2EyjEtOEfru4CiR-OMud4ekYSgFjZI_SuM7LOuAMbvBowP45fEiFSFUmzw8UljV8BP1B_4cLprv-yvn_jT6d1sHkOoJAd9LeMcmf50Bi1Od3K9ih9xlAUz4JlU31Y6FCmLbV3WMfkpSweykmInjKjJ1mkCyYElr1m9FjaPqNzekw7xohnzwutDwaejrapsBrFimqBFdNsX2aAMmfSPi58d1SBhlib6k6Pj-j21frD53zIRz2A2HMIC3Mk_4WpJ5Gsc3j_4Yl9wVYSzyl3lcZhMS7ytUcOTO69vP4voB3F-otOEZzVrfINrmPBc2ohYsd4i3yHYOUFpf60XUcx6IEYyagmolUIjunsr_l3cXGgO-dKjzJAv-OAL_xnpz8eqZ_xOKCw9j-exizF2gh3vZ2jEWn6im6fx4d6xCV-VWHlrxTFVV3Fhv_v6AJX2RyHwj9qUJHw_Zh7_JwuTvNm0P2RPO1Ulh0FthDq0egvSwMwMsSLqLnJo0z4rLTlphz_7nyRxbQuXRYkylabs5OGIvfMaDUAefEHOfStDVvmW0-LCtm3JRhiJ8Yy27jshlTxmF1f9qwaBJWrKnc6RMQ9da-880gCysqVNGWvqU0VRZ24KmpwCTs2il1dQe7CURDUFjmpEjp8NHb45Y6KNURo8q6VTlhxhMYcK2dubeffGxpZ2X9j8ONujACLese9uZSLYEMT2fnLU-NxyZWRCOboW2cHbEaw5xJffHGJn9Aj1BavKAm3HB6dXRZku3HoDjD2tL5zT0sUn7H368YpqAyVNfSEeI8rLenzIkdQn-x05no8zSJ5A7RrsRJqknkiBChiWKUguxpLv7QmzAL3CAPPJMFNo6ncPuDT1x1LY0WMeP7TfHc7Irpoe6-ziYrmiTla_qtqjCTWWM3bACvracoZqkVy4PFf05iI6knrF9z3pHpf7DIGNx-W4rp0YnI52F4TSZFCFn83wUN6N47b7x-auf-XroP9QZD8uxYEBYKkr1g8VVhdiDiX8MUvEyWWQoiloaaIw0P4SSBwFLNmEjpTgU4gAEaIrGq5JwpzX1VairCCnjo0kX4N-SF7F1AZWWAm_JbowqCld6JYejLoWy1vmi_z81FonCePO4s1WzRwUuPDPPik4Ki1nrAuPbdHPXfFy-QToozy4VzyUbDriz7Cky380dp8fJ_dRvZrIW19AnbbNo-FS74aSQwg-PAbiL8sVPMR5xscxtpQ_ZbcBC0A6j6TRY7BZl3bcM1h0B35c7VGQg-xq3UDSCkWl6YXYIC0EdcsVpS4cX13qlQXuacHCMrQ1HfY9Yjc88FVR3q4MU5wkEUnujhHIphkSbyg8Wz2Z-lLCoo1cXBt9DOEqEvw1KG1fKCXgt2HlvQX4rpTb1sWmOtpaMskM7J-VLTnXjHjhXT3AMbpDDSdrTKdMnOPJiCGnHWALfGN83pIlVD3eJ7LtQgudB77fOIzXk4PdkVgCOWq4Em7vCEVLHH53cmKxPPZMzEsUk63DMmG-N_iJNwaJUKtB3XQzWiV3Wve9fx0SfyrW0sLJ1SpVSZQe-bhPiDSSuJVetYlUmcl1a5mv3QcJvGigPmiocUQd07WQ6-bbQR5Hw4SJcLz2K1ueSmBCe-1Q5WzYFbNfH2Q5o6GE3cYn5tF6kBlNi9wHEJLDt7F75yQvDYVUZ_EAbrFu_1sL56N8p6N78_82xjbY7oFNmGdaTgor3qWZVEOoU1vJe6YN7uXzLpS0UTLW7wAmPFd0mVwaqftgwPQbVLEiY59sVJWSZLI4kTE1mxukLSeG-npBjg4u4xwefJHUNmcCE1a0hnPoWZGDZoTEE1pnnHfdNP90TEiajaephEynoW600o7W5UuiQoa3kLaeu_kw5VVkyVBxSq_hRTqMB1pFZ4s3LyAEIZR68zcFDv9h5eYKzBdC0S1SpqiAzLD27LvmU0B-tzpasH2ot1AAytKSF0SciWt0Y5wI4VZbJBSp_0tMYtQSjL6Kvj8Ma7RdjvtEu3wTJmMWDLO5iyq3t9RcKuL4t_TcCcPsqPtw7apXrZF2DrmB_HPuoDgjE-XlJBge6WbGchroLKAagGEZgdDWcSg2p6ue8ZMXLIIuEeB5vg7YqYcnxcH1N2qzRH6NRF-HazSYuL_nQzm679ilasv_lKIYi6IZMHFCWzf7KYhCM2tzwU19HHKXynBobjD8dJo-a7AAVfyWkNCQUxg3xdGf_r-aYcKwma0DPjWTr7Z25CDu5zy11yNhN2nSkVoW__PpLuM8eY44Q5bO5dxKokcV9Spg12NfKl8GaW3FNRd20_fBsfTXhnOl3J7N8YM38YpuYIsUVp-AtiaN7ilUUHF88_qXNBP5cseo-NPHmtKwd02FuDPgqbm9hab6ETP1MsruoQUG7lTyoFkjH_JzzICzEZqih8AI0z_yVTChYX4lOfx4SdxFzCX4_semFc9VqilEBR_5g2tJ3VPlnMYy7yLbfVVlc6gdZpapkIy-m4PeNi0NItl4OoFPAPzm36QagMJQZlHnVxR0j2T&cid=CAQSMgDICaaNKY6exEGYVQsJlDpxH6lectWHIJ2z-ddKA5QnAjnWBRhuvuAdXhfrmEecT8dpGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffinclan.com%2F&ds=l&xdt=0&iif=1&cor=2420851283490240000&adk=2835632808&idt=118&cac=0&dtd=162

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ebeeb0d9d88285ad24705c414185ac83096e4a7d8ff88456619d10364929d69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38477
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 83B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEL2BHVxWwlQVycRHoBN3r9w&google_cver=1

43 B
953 B

67ms
66ms

Image
image/gif

68.67.160.24
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEL2BHVxWwlQVycRHoBN3r9w&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNXpjhy_8MjqjBmUkw9TJV3iOAOs3IoR_oyJvxBN2eqgtV3AwNuRZHrsgqPrRCiQro26I4vM67VPQm1a5BKEaGbIca6417wXo73b26PMAqhovvB0mmY

Protocol

Server

68.67.160.24 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
an-x-request-uuid: d2aae0ba-2ec7-4f86-9723-6007e16a290f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEL2BHVxWwlQVycRHoBN3r9w&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 83B6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDM5NjY4NTIzNzE5NDc3NTI1MA%3D%3D

170 B
188 B

76ms
75ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDM5NjY4NTIzNzE5NDc3NTI1MA%3D%3D

Requested by

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
an-x-request-uuid: 4d527404-45b4-420c-a591-6196a6ed95a3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDM5NjY4NTIzNzE5NDc3NTI1MA%3D%3D
x-proxy-origin: 70.28.97.142; 70.28.97.142; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 83B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_dbm&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEKj5qImGZMRfT9hKiWu4l5s&google_cver=1

42 B
703 B

66ms
65ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEKj5qImGZMRfT9hKiWu4l5s&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLiT5AEQ07PmARiAj-WzATAB&v=APEucNXpjhy_8MjqjBmUkw9TJV3iOAOs3IoR_oyJvxBN2eqgtV3AwNuRZHrsgqPrRCiQro26I4vM67VPQm1a5BKEaGbIca6417wXo73b26PMAqhovvB0mmY
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c52bde874ac36e8646ae455e9e84952e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEKj5qImGZMRfT9hKiWu4l5s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 83B6
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDViZmU2MWQxY2U1YmQxNTQ1MTM3MDBhZjA4NzMxZWRlNmRiYTdkNA&gdpr=0

170 B
188 B

70ms
68ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDViZmU2MWQxY2U1YmQxNTQ1MTM3MDBhZjA4NzMxZWRlNmRiYTdkNA&gdpr=0

Requested by

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDViZmU2MWQxY2U1YmQxNTQ1MTM3MDBhZjA4NzMxZWRlNmRiYTdkNA&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F0A0
Redirect Chain

https://x.bidswitch.net/syncd?dsp_id=16&user_group=1&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dbidswitch_dbm%26google_hm%3D%24%7BBSW_UID_ENCODED%7D
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_hm=YTc3ZGNmM2UtMGEwMi00M2IwLWJhMjUtNTA5YzY5N2IyOTBl

170 B
188 B

70ms
70ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_hm=YTc3ZGNmM2UtMGEwMi00M2IwLWJhMjUtNTA5YzY5N2IyOTBl

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEYzZOV1AEwAQ&v=APEucNW8WrwqKTFHgAdO6XueZKtd3E47La3qZUvLSwk_UOJij1j8t6N_0LvIWfCsUN8MkCP1rX1wW1Bt3C3ngC6A5JVPhFSXaVbfqLiFzb3ydD3muvGFbSQ

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_hm=YTc3ZGNmM2UtMGEwMi00M2IwLWJhMjUtNTA5YzY5N2IyOTBl
Date: Mon, 16 Oct 2023 14:48:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame F0A0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAROXD0mFrEESpQjrPmh2LM&google_cver=1&gdpr=0

43 B
61 B

48ms
48ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAROXD0mFrEESpQjrPmh2LM&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPiUcRC-4HEYzZOV1AEwAQ&v=APEucNW8WrwqKTFHgAdO6XueZKtd3E47La3qZUvLSwk_UOJij1j8t6N_0LvIWfCsUN8MkCP1rX1wW1Bt3C3ngC6A5JVPhFSXaVbfqLiFzb3ydD3muvGFbSQ
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAROXD0mFrEESpQjrPmh2LM&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F0A0
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjQ5MWVhMWMtODExZC0yNWJiLWVjMjctZmQ3MDY5MDU5NzMx

170 B
188 B

70ms
69ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjQ5MWVhMWMtODExZC0yNWJiLWVjMjctZmQ3MDY5MDU5NzMx

Requested by

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjQ5MWVhMWMtODExZC0yNWJiLWVjMjctZmQ3MDY5MDU5NzMx
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 audins.js Show response
go.ezodn.com/detroitchicago/ 403 B
697 B 58ms
57ms Script
application/javascript 2606:4700:e2::ac40:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/detroitchicago/audins.js?cb=195-2
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:890f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a0a819dbf31b6b41679a3eddaecf644f21177472e9950334317344856b356dd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 Jan 2023 21:37:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 24513050
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NFcvha21xtHJ4a%2FJfBTv3KH1d%2F706QWAQiwQk8kWSQYogB2GXKeWTm0Aj0keCOwewnPEZOjJkDQs%2Fi7V9qfHfWw37Qk5Li%2FTMU%2BJs7dGqkOd15n9SBG1uWGBxBESi%2BlcaJo9kuVUUDcwAV4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 81711a064d172d19-ORD
alt-svc: h3=":443"; ma=86400

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 58ms
56ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQyNjUwMTc4OTY3NTAzOTEiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQyNjUwMTc4OTY3NTAzOTEiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjM0NTM0OTk3MTY3NTU0NjQiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjEwMjEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjY5In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzY5MTczMTk0NzYyMjE5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMTE0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI3NSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 84ms
83ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijg4MzExMjI5ODQ4MTI3MTYiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTY3LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNzUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjI2MjgyMzk1MTA3NjAyNTkiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNTgwMywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 85ms
84ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzMTUifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjIzMSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQyNjUwMTc4OTY3NTAzOTEiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI2MzgifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjIzMSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQyNjUwMTc4OTY3NTAzOTEiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI5NjIifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjIzMSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjM0NTM0OTk3MTY3NTU0NjQiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjEwMjEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiNTY2In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI5NDkifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzY5MTczMTk0NzYyMjE5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMTE0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjU2NiJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTEwOSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:14 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 84ms
83ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIzMDAifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6InRydWUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijg4MzExMjI5ODQ4MTI3MTYiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTY3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMTEwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyNjI4MjM5NTEwNzYwMjU5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTk3NiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjU4MDMsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjE0NDAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjMwMCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CFBE
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1f_3mr8w-2MhLXl0XH5CB-KZjcDcoJQ

170 B
188 B

76ms
76ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1f_3mr8w-2MhLXl0XH5CB-KZjcDcoJQ

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&us_privacy=1---

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1f_3mr8w-2MhLXl0XH5CB-KZjcDcoJQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

/
onetag-sys.com/match/ Frame CFBE
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=2&uid=LNT0FNR4-24-IKB9&gdpr=0

0
291 B

104ms
104ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=2&uid=LNT0FNR4-24-IKB9&gdpr=0

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://onetag-sys.com/match/?int_id=2&uid=LNT0FNR4-24-IKB9&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: deb9f124eecce7a554c70ca983265c95
Expires: 0

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame CFBE 42 B
703 B 66ms
64ms Image
image/gif 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=c91RPUBZWARAXY_xiMpPKf6X1tyD4mJeE5tqOt7V2vU
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c52bde874ac36e8646ae455e9e84952e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame CFBE
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
https://onetag-sys.com/match/?int_id=107&uid=6098153373786994889

0
291 B

53ms
51ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=107&uid=6098153373786994889

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=107&uid=6098153373786994889
date: Mon, 16 Oct 2023 14:48:14 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame CFBE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

0
291 B

102ms
100ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame CFBE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=92&uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A

0
291 B

53ms
51ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=92&uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&us_privacy=1---

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=92&uid=y-kHZuLqJE2uGCxRr64v163pMRJQrj8DmKH3trCNA-~A
date: Mon, 16 Oct 2023 14:48:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABB2 0
20 B 118ms
117ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7932115460707&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABB2 0
20 B 116ms
116ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7932115460707&version=m202309260101&ct=76&x=38&cor=2420274292756573700

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame ABB2 92 KB
38 KB 112ms
112ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DaNlSI5uLNL0xVKQTnB5uyHp1OYId4ik37iuCKM0_SV8Ix-r49eIX4oROqof1g6eaLTs8QDDrw6eOtJ8svVL-YDKi9pRdJ683Ab24tRj1Luys4YMWSO3BFC2eqf6M9M5COLvuPPfXa2nmBIgKn_gNV58OGTvZJJ9143g34tbUu1QYTOoM&dbm_d=AKAmf-CNRXhKa-s1iakEimDj-w9QqkbZLHKeBy8oiyIx-gAMwHo_z7kvzzCQgbj4Z1Mmu5lJlzaAni6TmcKsqJWWAavvPqMpx4ndv_EsSx8OCyeN1hYH1ThAFSyXpU7MqrIP62_bbPWnF49kix93S-DQ_cabxkGD9GjWVX7yBQbglu3kbmzK8NlGe-6Y4Sz14mlhAJj5Dm9oXqWe6gKLCL_7yNM6O8W5bKdLNvk7d3Qepmsh9o3tX-bf_BS8foXJTdIzZIc3z4LQpS3Evv4A5N6Sh3I4NAQvdpgyPWVQmTaAcmWkSE41uYZa7mAAlYOqZGhtPUfwgIZVuJFUejcZOr3usIArIfNb0h5kaOuyRqsAVKFG9JSd2xrCXXFSnUKwYnIVU7FWnWaC-vOz0JR7IfSKgfkgfrDv6JY05Ohwqjk6w8o2_XnCjwCGRF6XfWHiuBV7Xg5nwJLD7eO77E2Iny0bMFib8ll42-RW18GDiUUqh0OVh1Q1NHqGDlhhLNkiteFNUb4sXjdNo3s7AB4dAOeuee72h1qOCW0M9zwo-on2CKBSEzZnNegNqWBkI5LlyoS85hoqBJXbq4_jnbD9w9webbVjHWEszwd2vDOsO0Y0440z431DR1f9hyDcpehbtw3O8mVtW83UTw4E8YMC5VMkK3ZhReT7t-K6akEGCdyeVr-x349YNGueo8RBmVj_EAN9y8Jeevbc5tde1R6laVQUC5cScOee90qrVFHnfUVRjcPGngadw1ij1whH2t3fkl8brbpYAIugN6jYRrRF2l909sWULEKIXgKz-xHL_KPF-MrXEYiE7a9FHwLdYEmHdxGvvGPXUzUa-Veuqrn9dve_XiqFEduE3icc2_spdhCaV1YOKakQbG_W45ZwM0qrcqCny81hmgpA9Lkx2qFqyR974zK--oOneSgMC2mN9SJYdfWn64j4bFsXMXveKuYS1ZtYXbqhEkXPKTVHS7vWTjGlPm2HkJkG3K-D8m8uyuh7AWkogzLuLhcR4F0pBsmyrP2ZTVb6MnGg6LiEgepeT3pEClJqM2m2JAAC3OYbLpHrFNdSNg1CBQ88oPN8SxhZuRdjwXe6fErE0i1GIyChCzOB1gczBwwab7Udt7JhbxVoD8jtvOXfPtmKHbO_U-obM9v9fL87Rs0UUYKAcv5r8r2hKtGfHi9reLCrbGc2ZuDyNgpZSMVWDBwx6C-k9ptoh6P5l9ZH4A0ASGwAKJ1bgrn95og0l-wPVnfk3TNLUWTZs2jE0dywu0Fr4hdjLV2ifNOt7U5tchjUz-NnVvujZ85qlh_zAVpjQtRYUBUq_PJS7Qp3MFPaCyHVGHtbljsp7WboeNAAccnCt71jyWZoFHyd_cAPU82smPJFan-5Hwg_mjzhzaWht0eFgFZCI4LlbVlkzDxsvn0kFmWt-Bmmr9O35nM6uHS96yQGnR2XZT7fuKX_PVRdVpDBHKLUBG8F5cYTerlD5I5Z2X2WAv4B_lBFVKFc1OvpCGOfZByb8sGRvzuc5bM9-06go1cS3OMU8gPCl1zBpUJcPqqs90avOIOL7Md1V5hguRZeVKT8rLN31Zwsft104dbaQ6lJnfdK65VS-1lMt3hte_nccxRF6vleePOn7o8x1Rx_ZooGrFseR0zchcqn-cItLHx1YAw83Tdp8_GyY7xSw_F1wK5txy-ePNQfhfPMaFJJCLeTSEPcZo4AX6INWu2hWbCtEfnCjKeUpeMN5r2i3utlMS5_u_LlxWOhhNhMODW4KNwnrLmEuqvyjCYj7OhEA_IB15ReADhTR_5bvKgBRKc4GnLlwMHVSzvnQf2rVbWJYCFe6GBItmQcwTBzXSOoMidQh-dOSmE7C2By_Tv5t3PUWlXoXqSpWGRFytrwrzRUyqKhnF7fuRlidRXh2Kg5LexLdVqX2TQKYSE9j85L4HMuG0RpqujwWwy04eBQudkh4HoKRo38xkiGKp8raD15pM1NGX_263s5tPV1G0-AL_lXadvDswrWb5wDjtQdAIcQTfEv8QKL7_DiIrFpEJXZFiseYAPY-ly_v8K6tvnQEobTlA0MyYSvScoxM_aJNbYktKidQMkjhL4G5PXqsa8qznxes_dWGdwSTW9otaezO6rhRJjwTlak3BwQEphcI5f-X3qQOza5qwj-oYFBodmFH9REmseNrasYi0WB_WeN8RsfN6xO_XgtJmOb-3TMQ25WI4o2r5Ctri5q8UUhjUAGrvve3aXy6JLgirh0xthRE-yLj6guIiHgG10FazC41qIP0PLCkBQAvxMudeQgmMY0H2w3YN8nVFDFL0dQS3lDpjRUgyNfL-e9Se-xw32TvOWDl_jyXMSYljkWEsFdIx3ryBc2JDFoqgzq7BEYU24nMvdpp2mJCBEDd2I59HaE4J9YRbBlQ8c5MEe2Rj-cHtcSWtq3WHCBMPZUN7heF2H3tjRfldKxTcEJjraAirvRaXeV--TAt2LwjETLW1vu_r6D0K0ltkgNhhOX5hzJ0YpjAIJcgtoHpSmioM2rd03qtxIHPjg3kQtW_YRuIKUfpKF70h6Ttf94pfCBk2kE1ugnvso2AKkhQXsuhBEfcWEJ5PixcYll_nUvMv6TAL2VZwMDvv8mKDLLK5xz5BVhtsEEc1h8oE0scBlOAlLaOF0KWSkRiafR74GD-N9nEzvHv_RShlE2FaElFwrsnSERtd4lLuC3o3a_tLDss3OHx_TIgqWrscQ9NB1C8y1ifxDe86dJS8sg-QRs79uKHtHIo9gZb-jOpkKGe6-mfp91JmaHJGJCq-xNiNDJ4KLe7M2gI4DC8jzXZ8qATCdSuqJUC8YkvWF-HdiHwSxSnkCaBS0zfxSawUhoABaWdarPN6B5yPpGp8rUi0IpQ0tD9txCTA7fdR44eu6JMbDktZ6PwEYE5PPdTi4ooE2sCP8qtT39JXoHtuuiJ1PvzDtghLi5mxas9DL2HIsAT_PJeEJPAJNbaW6mBO8xiYuwmxS-FtMsIu2TEG8CdnnkcsiqTcxh_scmj2pViV3owrY0-3vY9g2pBspTJX0Y8kXtD-yek7m5VG9OC6pK63oQb23JIhQCdbNbNhmn_TPD2-2NNpcQi5DJBcGYYy2NVfAY3MRbZWrj5BB04ACKfqx0liT5N7m07y5Q63eSpPKTOj5r50C9eh5IHPi_ROaVM0GUQwspeJ7b1NArt42kymK3bH95qxkCtSG38a56GAScEVSpweYzVUcv_RB1HzFn_nZOilxUs93w-ij792Q-q3xsTtRsCtXzrDD4EqyCPhEGi3WtKsY1m8gB0XCUYDL1xkaAssFj4t28sVYOPYacAyvli45Yeu3ARCfeds2ovW9k0DU6sj27e3CaduXBkJg15L31ZH-fZYPMObpvw65o98s96YS67iRt504EKpVAo9jbpcNYgHgF9FHeGRtM35VtDeJxvzfrLkSkAmLO3nwZwiZjI5fuL5KI7NH6L9beOXj_gyZLuS0jlbaMYT6vBfldEy2GVcyYclKT9FJUxnLOlnMhlamK-v0Stl9GGIWytLdXvr9-jjVnR9TEqhACAmUkmuAFAojtU6CYwsJH50WSIqHYLiyndkWr46UdM3_Cz5FgDRWYqkWbLnw0Do282-JBS-gqxUumQuIiXRb40CvDpVRholBBe-Cqm0u_&cid=CAQSMgDICaaNMnmMaCtPGdQC_vwHIPH__R5hyH8WN-J3siKUjBikGiZ2MrQCO5CajtOWDgGmGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffinclan.com%2F&ds=l&xdt=0&iif=1&cor=2420274292756573700&adk=3258648037&idt=137&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b245b1c052de6ebd7a2639b91cf2e9dbc732ae769f21c0a6923ece941a721e61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38479
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 494A 0
20 B 114ms
113ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2141833623878&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 494A 0
20 B 113ms
112ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2141833623878&version=m202309260101&ct=76&x=38&cor=16187705444291277000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 494A 18 KB
13 KB 87ms
87ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AgdCBEVF3ShPORA1pMnR7fASDHuylTDF88WBuMdlkJ0LJU1LurCxh94j_YFVMnFPwwPiQ9U63BBrzm4-lCvgPXXfv1X6KmbfO8KwMnBv66xUQjOA5ZJQWNpqcCu1tAqLa4Ua-QbLDAUiDj0v9VO4zcso90z_jD1eEoGAInRe03buVVS0c&cry=1&dbm_d=AKAmf-D89sbpUqGfbbIABR-jw6svv9gMYpMq9Ba2gYkO8F7F8nZVlDeuCRH8aRLQekkzhMwwmgvssftSfV5gp2IIBRQfeztlsb9NTIbs0P3_xKkT9OP5faPERg4eTpHNklwUYrS4LGXHUHRx7eRsJo5rGozqxVDK4w87XDx326BkOPXLjFlDiV21LCEXIgKIDoiB5XP2QrAkwlFtbfyS1CCG-QE_mrq5UM6ZbbT8RGpvZIhTpeKLDTvyjQJoe45tOz9pVS1uswbw75HKGpLXr8Ruo1qsXxphnvE_-MTvwuzNw5Dot_FeHBTibtlvrHRocH-5tbo_60roy01iE4XU219il-0v6hbZAMwSKLfBanmhZiaFKU821LzNgajHvoFdXo0yJi566YlHP81p7FSQN_W5QQCqsGIEe1o_dUqAMRH_Vkvovrkf2Gls1NdlTWuzw40IPuoi1ayNtch8jbcGFda0lrtVoFWNl8lNHtjP1uFkmqDNpzzVNfK9DykLUXb8qbcIA2E1RzdM666ezDQ-SjkahLigMyz0BKxY-90RXqP1GAbpEfu_LSYsRgaITdKguZdVSH68yC3kwQjCtzxReMBEMVjipcy34vmKMWASaOqFlqit2sNYcfMr1mHvrfYUWhmD0nTon9-g1H0B6rEmwCVeNrvY0-Kh1ma-F9lqKozcsDW7PRemOP19cbp0Um6mu0ilNbHhfnjZevpVSRFw_R6oaQCtW2Pfw5qVQ-WyndlwoNjQL34ceTwoSKgKGGkb1M37hwHv9O6-u6R13A9_SFZBnxM_VskN9s0eZ_fOpDojwDfJjBJCN2anLpu7Z2t2GCkZKmZb_k2yLEMlb9KOx6-aRqs4c6dnSg0FDYb1WztqeIbXS6AJLfriupwBlXuR_pCYdoLCELaT0j7Odr8qZm_wr_zv2vuzBsSPKd2GztmsBECMn2cAahjIARDYF-oWU6ZyK2mX0SkDms3e3sgWMMaQLW3x_oqCuO31vjjPCmGZGMUjJaaL6NVsBEZHe-Z5xWLwyXDDNgK6uaELjxfrzmsPnOc9i3YpXfCWv8LXXGehfGZ2jhDQ2ZVPcrh9lvyqESwFHenbisIkGEeOJsuaCjHkqqbulyXU0m2dnM1buorX-SoyKHiRHTs5Ik9ZpYRp5YwSjxUyjrsK41ex8Ja-WEDUuNS4RsnKDGScKKrjUdbK5FAI0mxkx4FkiLsg05B9HPxFAlil0kEcZ86eQp3f-o2ZcVnzTTKZTJfRvhHJ3WSbpbLi_LLnfnmkBivofmqQvxsG5jFEhKUNlYm1xMuhBGsZooB84IwWYjTE2796k_2uuX8Oh_JOh-dpzImQMdcjBJPZS0e_abQoaI_GmUuC3cV8OJZCH8qX-UL5ouBrOp298OXw_QmjVDyzLtm9w2p2GuP8dzznSHg_a0VjJ9XAdFq8dTy1G0LuyDaOesczE577Y7cH0oDUTeD7F9ASH0xP5C2fkUKBNKFCHpr8AfPdpyiWXcTd8iuYREwN3pjn1lTLhD1nLYLkQHHNeBKn9juVsZ5tQ6a2pHA_ZtP1wp_npgk9ACUp2yHcv3R9Q-OceoPqK9-MhpOhHQPZ2TM-qE0SvWCt6QVrZ5fRAcNEKWMi65gjzAK-YfKxVR8XMLrxuJ1xh-Nlzz5qyQufYA14XOLZsXyeDhgkvfPqfLQhZBDcliHdMj7lNAbR2U90CXkw944KeM9EBDokF4SeBRYdyjEavYGCh-d3k2THULD-wKut0tmdHuxbmt6IUO7BGktQUuN3ENMG3ADLrLcdekgBPx4f8YVA6srCwPbRi3WtHaevcazk1Rdp_UZQuN8fGGRchwjTjo29OARwHqI14_qWqEn4cS9OzjCOykzByu1DHfhMlmThGlqdbztO0N_qyihsCIU55YObs2vN1Wiun1cq6l3wiPnn2q8dLgM7WHwg3s56TtfXW6SRdNe2m7TIoc19B7AT8uw__INeQkeUGCD-jXxlRDA1-v2mKodscdnCgimEqZ4aRIQ2n-24oWSchYlzgN6XJhBqRAiAX5T5tnwzfE00c7saNvqYciOoAAAglMHw_sDUt8aDTEVnxRwLn-vNZdIFutOpn7y0MI2w_AWBf7E1ljC9rUCWdipF4iE_9bS8a_UfGbtivNGhZlGMC2gJJ-cu8BfczGP5HhbEsFSl6OW3X4MWfaaNqWZJ6XvzTbwllOxUItFF3UtTmboHbgkW2loqPuhnouRkVOdfkNVQUju5dffhuXa-DaQvWYTEXW4ZKD_F9oZYmR-HbkmfLu3FawmBoqfxEKUd150jTdFfG1tU6ORm1uv1c1np2UXX-eyivhDv2ru_YOboSvLAw-pdG_2WakWN3c-iSlKAZybAukNLAohmXEWUXURwIH43dKPQMcogFBDzVp4y2B4-Sh1QAR10dvr7hPp_V1mKunb9Lj_sp6vVnQ_JC2tD5DIDjdR1xMuh-GxL8be00QZn0sV5ZIHU3BoR0at2MqML2nJ_5xQjN-BI4VVVqBW_wV95fA6v0RHQa6x1FfaW7oQm62kizTYLxOYJuSN2Eczi_F_7ABm_LLyJCsRwmcMTa6U6wa01wFIcp1HMbaVKAxWR_wBzWZiXnM4eeW6Efs1t6M6soCcs06k2Tg7fK7UGYcPCMf_Ro4gzZqtsWHVF-fjA5HpsdDu3BkWLfvnAYSFkG_u4Um0qnO51doPN7FBxhH_yYZ34EYutISZc1sJjr5yK7oI6Z_FuaxRaIvjMczIGVOKmXxvGFlZrCevjD4oQnIVKEIuZ8Tu2xhY2VAuRsKYizQKMRPri3i4P9slsPk-Gpyweq_LVxyp-TPQWUG5oh5n8YOrJQZ5uNQb48PAHLnoCr-eu07vsRKJ_KqlbMhrNHhlA0GWr-KxfGLjy9olg9fYWx23xb9h3-PuYXMzoBduApGjxQCmCoRJRNMEE7517zffSO7SoFm4oomkSQCt-0eWYv70Bx0NsxbrSA4M0w9O1J8g9cTBLixGwQ8g_o3Adnwo7ISbQRmBdfLX2JShINGYYt_qtIoWkG0CLlkA0uudYKWEFnppBLU4ruS2ZMonMrhsHo7b0hMG2IDypGKY8rULhgO5M1DiVjzx6wu31rSG1r6iFSeWWGi_iNDR_uFk&cid=CAQSMgDICaaNKyGpapAQJo_L7HIEdPH07AAs5H9N8p4OGTu2TXrZNT9H-nNoVbPK5FAzSpOSGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffinclan.com%2F&ds=l&xdt=0&iif=1&cor=16187705444291277000&adk=3478109552&idt=146&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

916420ce9b91fe37c863a50355930b5edbb99e50ddc9b1f41a6a992a289c47ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13398
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame DF3C 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 633d93e1cc5ce13694907897c6ed15af632538e468bdf30256499fcf75fe6c28

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C8D7 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc71b050f0875616b99bf72c350b6268a96bc13270a6200827c503156d6a81ea

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 2501 0
129 B 70ms
62ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156983&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 3942 172 KB
60 KB 288ms
62ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Origin: https://finclan.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 74143
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:12:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame 3942 11 KB
4 KB 58ms
58ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DfOPWsGmLEVAcUKMHDbGEt1hazV4eZp2u-2YWYgeBbAjFW0_Ovw2981EujTrbiO-CwwoQ7_kTZqbXfIEaZPs-jhE5CQzHtnQt0SmD3h4Td1Tnsxp7b5ThrsL67DgZHZh4F9pC8CoqbFwDM9UT8hDbXv-WmCEdaESUi1Js4uWsdqcGNh8c&dbm_d=AKAmf-DDiXli7DymPQ5ZE40FNAaey7LZQ3wY6pcuo0Kwpg0GXlArTNz57OgCjzXXhAEZIWLCqe2Vb_xlA2SNX-FQvkhf0pa00y4TBqjCYpN-TCUFl-9iS7PjzFESgjq_929U885J-VVJFTM_EXiJOPZHEiygHaQAVw8hXxtsCKnJaBDes72rA8L4Ni7mQJmojECCk3_ijwnfpKGf43lqJ9M1nqhx_Dh7xJvdyO7UefS4_QeRY0GBGRSkJY66cj5rtAFm-eFLSP0JrTU6TOm0GZBEBhr-wFrxki16Nph5UYMVxg2C-iU7DIQJRtuFC-Lo9YTXdgWwQZ0A__imOwLG9cFxWqvf_neuNmuQvBBwrCf-X5uMUtJ4Er26HYo9n3Q5qLmQciGLRHNaq1d72kdUQvub6IwNx0WviDP6gxhd6U-KbyvJgUT7ewrHOxypHTcZlwE3jkkeU_kbJ4BFmeIxHQ3pXSb0wChrQ0c9qeUPHQ8_29hxBuTLq_iq5MucPmoiLJAdJ6pxWfTQGYmMku8FDe6vXka9WP8xWigbAbSGLw9OjYJJXppYRPiIbbeLjp-cxTDGBNQnpvzGRCLStCMY1JLXu-w0UJMgoq4VJyE6r8VtDcZylCa8nAz4IGHgB2bmnlXBMhF7JswXlEEo-N1kE1dCKMOy-ZAH5r6oXV-Mg-1-fwFPGfbfgAU_F5z2l0V6LMuF7WLKFo7hfJBc2KOqoht-LeOPDaezbM6V7ALvJLd6-7yRyRkOFfXKjpi0KNrarXFAlUqsQE0g-hYe1qwEGjC06262nraQ0dsj6vbZHdvUbGX1lqKWR2I7OYbI1EyA3eJv6MPhfUOW1Lrj-MCLdBXN-45eorq1hn4UHIre6hif_fGqZNfv-_Uq1BAPZU3acJCz2gmDiPLza_VTjb5ep0mCrv7-eyNEJwOBCHDKBmGpiOIcnuKPUOwXXsJQ0LPnUebXhLtRbYYruRdghtsev_2osFiww-RvqgzYIQCUnrdvqBA4nWvDfyYqVlWZK25UYM5sP9Xb6jUrPt_kVjzX9vqrPQ-m_dnqzJ4pmNwgi7ZpDtYzDobj2Yh9aPv8M4G9gwel5lUfWheUooJ89IjPX3BiHPzRaBp1HwuIMobkR8wF20rarRH2EyjEtOEfru4CiR-OMud4ekYSgFjZI_SuM7LOuAMbvBowP45fEiFSFUmzw8UljV8BP1B_4cLprv-yvn_jT6d1sHkOoJAd9LeMcmf50Bi1Od3K9ih9xlAUz4JlU31Y6FCmLbV3WMfkpSweykmInjKjJ1mkCyYElr1m9FjaPqNzekw7xohnzwutDwaejrapsBrFimqBFdNsX2aAMmfSPi58d1SBhlib6k6Pj-j21frD53zIRz2A2HMIC3Mk_4WpJ5Gsc3j_4Yl9wVYSzyl3lcZhMS7ytUcOTO69vP4voB3F-otOEZzVrfINrmPBc2ohYsd4i3yHYOUFpf60XUcx6IEYyagmolUIjunsr_l3cXGgO-dKjzJAv-OAL_xnpz8eqZ_xOKCw9j-exizF2gh3vZ2jEWn6im6fx4d6xCV-VWHlrxTFVV3Fhv_v6AJX2RyHwj9qUJHw_Zh7_JwuTvNm0P2RPO1Ulh0FthDq0egvSwMwMsSLqLnJo0z4rLTlphz_7nyRxbQuXRYkylabs5OGIvfMaDUAefEHOfStDVvmW0-LCtm3JRhiJ8Yy27jshlTxmF1f9qwaBJWrKnc6RMQ9da-880gCysqVNGWvqU0VRZ24KmpwCTs2il1dQe7CURDUFjmpEjp8NHb45Y6KNURo8q6VTlhxhMYcK2dubeffGxpZ2X9j8ONujACLese9uZSLYEMT2fnLU-NxyZWRCOboW2cHbEaw5xJffHGJn9Aj1BavKAm3HB6dXRZku3HoDjD2tL5zT0sUn7H368YpqAyVNfSEeI8rLenzIkdQn-x05no8zSJ5A7RrsRJqknkiBChiWKUguxpLv7QmzAL3CAPPJMFNo6ncPuDT1x1LY0WMeP7TfHc7Irpoe6-ziYrmiTla_qtqjCTWWM3bACvracoZqkVy4PFf05iI6knrF9z3pHpf7DIGNx-W4rp0YnI52F4TSZFCFn83wUN6N47b7x-auf-XroP9QZD8uxYEBYKkr1g8VVhdiDiX8MUvEyWWQoiloaaIw0P4SSBwFLNmEjpTgU4gAEaIrGq5JwpzX1VairCCnjo0kX4N-SF7F1AZWWAm_JbowqCld6JYejLoWy1vmi_z81FonCePO4s1WzRwUuPDPPik4Ki1nrAuPbdHPXfFy-QToozy4VzyUbDriz7Cky380dp8fJ_dRvZrIW19AnbbNo-FS74aSQwg-PAbiL8sVPMR5xscxtpQ_ZbcBC0A6j6TRY7BZl3bcM1h0B35c7VGQg-xq3UDSCkWl6YXYIC0EdcsVpS4cX13qlQXuacHCMrQ1HfY9Yjc88FVR3q4MU5wkEUnujhHIphkSbyg8Wz2Z-lLCoo1cXBt9DOEqEvw1KG1fKCXgt2HlvQX4rpTb1sWmOtpaMskM7J-VLTnXjHjhXT3AMbpDDSdrTKdMnOPJiCGnHWALfGN83pIlVD3eJ7LtQgudB77fOIzXk4PdkVgCOWq4Em7vCEVLHH53cmKxPPZMzEsUk63DMmG-N_iJNwaJUKtB3XQzWiV3Wve9fx0SfyrW0sLJ1SpVSZQe-bhPiDSSuJVetYlUmcl1a5mv3QcJvGigPmiocUQd07WQ6-bbQR5Hw4SJcLz2K1ueSmBCe-1Q5WzYFbNfH2Q5o6GE3cYn5tF6kBlNi9wHEJLDt7F75yQvDYVUZ_EAbrFu_1sL56N8p6N78_82xjbY7oFNmGdaTgor3qWZVEOoU1vJe6YN7uXzLpS0UTLW7wAmPFd0mVwaqftgwPQbVLEiY59sVJWSZLI4kTE1mxukLSeG-npBjg4u4xwefJHUNmcCE1a0hnPoWZGDZoTEE1pnnHfdNP90TEiajaephEynoW600o7W5UuiQoa3kLaeu_kw5VVkyVBxSq_hRTqMB1pFZ4s3LyAEIZR68zcFDv9h5eYKzBdC0S1SpqiAzLD27LvmU0B-tzpasH2ot1AAytKSF0SciWt0Y5wI4VZbJBSp_0tMYtQSjL6Kvj8Ma7RdjvtEu3wTJmMWDLO5iyq3t9RcKuL4t_TcCcPsqPtw7apXrZF2DrmB_HPuoDgjE-XlJBge6WbGchroLKAagGEZgdDWcSg2p6ue8ZMXLIIuEeB5vg7YqYcnxcH1N2qzRH6NRF-HazSYuL_nQzm679ilasv_lKIYi6IZMHFCWzf7KYhCM2tzwU19HHKXynBobjD8dJo-a7AAVfyWkNCQUxg3xdGf_r-aYcKwma0DPjWTr7Z25CDu5zy11yNhN2nSkVoW__PpLuM8eY44Q5bO5dxKokcV9Spg12NfKl8GaW3FNRd20_fBsfTXhnOl3J7N8YM38YpuYIsUVp-AtiaN7ilUUHF88_qXNBP5cseo-NPHmtKwd02FuDPgqbm9hab6ETP1MsruoQUG7lTyoFkjH_JzzICzEZqih8AI0z_yVTChYX4lOfx4SdxFzCX4_semFc9VqilEBR_5g2tJ3VPlnMYy7yLbfVVlc6gdZpapkIy-m4PeNi0NItl4OoFPAPzm36QagMJQZlHnVxR0j2T&cid=CAQSMgDICaaNKY6exEGYVQsJlDpxH6lectWHIJ2z-ddKA5QnAjnWBRhuvuAdXhfrmEecT8dpGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffinclan.com%2F&ds=l&xdt=0&iif=1&cor=2420851283490240000&adk=2835632808&idt=118&cac=0&dtd=162

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:10:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:10:23 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 3942 30 KB
11 KB 58ms
58ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:17:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73827
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:17:48 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3942 41 KB
13 KB 60ms
59ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50837
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Oct 2024 00:40:58 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame F656 37 KB
12 KB 131ms
130ms Document
text/html 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

fda030f0c7189457b70031890badf14715145b2ff6f5cf94bbb3e88a32c1c69e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 12406
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Wed, 18 Oct 2023 14:48:15 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
9 KB 94ms
74ms Script
application/javascript 2620:116:800b:21:1456:d0e1:7db4:a56b
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/audins.js?cb=195-2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800b:21:1456:d0e1:7db4:a56b , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 7c1b0b0523c8cd715c6a906f13a121cd27392d8e61d58c38c7ceb32ec22e59f4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: gzip
etag: "6ioqmyHWSWLYz5hkRjy8Uw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Mon, 23 Oct 2023 14:48:15 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 494A 187 KB
59 KB 111ms
110ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AgdCBEVF3ShPORA1pMnR7fASDHuylTDF88WBuMdlkJ0LJU1LurCxh94j_YFVMnFPwwPiQ9U63BBrzm4-lCvgPXXfv1X6KmbfO8KwMnBv66xUQjOA5ZJQWNpqcCu1tAqLa4Ua-QbLDAUiDj0v9VO4zcso90z_jD1eEoGAInRe03buVVS0c&cry=1&dbm_d=AKAmf-D89sbpUqGfbbIABR-jw6svv9gMYpMq9Ba2gYkO8F7F8nZVlDeuCRH8aRLQekkzhMwwmgvssftSfV5gp2IIBRQfeztlsb9NTIbs0P3_xKkT9OP5faPERg4eTpHNklwUYrS4LGXHUHRx7eRsJo5rGozqxVDK4w87XDx326BkOPXLjFlDiV21LCEXIgKIDoiB5XP2QrAkwlFtbfyS1CCG-QE_mrq5UM6ZbbT8RGpvZIhTpeKLDTvyjQJoe45tOz9pVS1uswbw75HKGpLXr8Ruo1qsXxphnvE_-MTvwuzNw5Dot_FeHBTibtlvrHRocH-5tbo_60roy01iE4XU219il-0v6hbZAMwSKLfBanmhZiaFKU821LzNgajHvoFdXo0yJi566YlHP81p7FSQN_W5QQCqsGIEe1o_dUqAMRH_Vkvovrkf2Gls1NdlTWuzw40IPuoi1ayNtch8jbcGFda0lrtVoFWNl8lNHtjP1uFkmqDNpzzVNfK9DykLUXb8qbcIA2E1RzdM666ezDQ-SjkahLigMyz0BKxY-90RXqP1GAbpEfu_LSYsRgaITdKguZdVSH68yC3kwQjCtzxReMBEMVjipcy34vmKMWASaOqFlqit2sNYcfMr1mHvrfYUWhmD0nTon9-g1H0B6rEmwCVeNrvY0-Kh1ma-F9lqKozcsDW7PRemOP19cbp0Um6mu0ilNbHhfnjZevpVSRFw_R6oaQCtW2Pfw5qVQ-WyndlwoNjQL34ceTwoSKgKGGkb1M37hwHv9O6-u6R13A9_SFZBnxM_VskN9s0eZ_fOpDojwDfJjBJCN2anLpu7Z2t2GCkZKmZb_k2yLEMlb9KOx6-aRqs4c6dnSg0FDYb1WztqeIbXS6AJLfriupwBlXuR_pCYdoLCELaT0j7Odr8qZm_wr_zv2vuzBsSPKd2GztmsBECMn2cAahjIARDYF-oWU6ZyK2mX0SkDms3e3sgWMMaQLW3x_oqCuO31vjjPCmGZGMUjJaaL6NVsBEZHe-Z5xWLwyXDDNgK6uaELjxfrzmsPnOc9i3YpXfCWv8LXXGehfGZ2jhDQ2ZVPcrh9lvyqESwFHenbisIkGEeOJsuaCjHkqqbulyXU0m2dnM1buorX-SoyKHiRHTs5Ik9ZpYRp5YwSjxUyjrsK41ex8Ja-WEDUuNS4RsnKDGScKKrjUdbK5FAI0mxkx4FkiLsg05B9HPxFAlil0kEcZ86eQp3f-o2ZcVnzTTKZTJfRvhHJ3WSbpbLi_LLnfnmkBivofmqQvxsG5jFEhKUNlYm1xMuhBGsZooB84IwWYjTE2796k_2uuX8Oh_JOh-dpzImQMdcjBJPZS0e_abQoaI_GmUuC3cV8OJZCH8qX-UL5ouBrOp298OXw_QmjVDyzLtm9w2p2GuP8dzznSHg_a0VjJ9XAdFq8dTy1G0LuyDaOesczE577Y7cH0oDUTeD7F9ASH0xP5C2fkUKBNKFCHpr8AfPdpyiWXcTd8iuYREwN3pjn1lTLhD1nLYLkQHHNeBKn9juVsZ5tQ6a2pHA_ZtP1wp_npgk9ACUp2yHcv3R9Q-OceoPqK9-MhpOhHQPZ2TM-qE0SvWCt6QVrZ5fRAcNEKWMi65gjzAK-YfKxVR8XMLrxuJ1xh-Nlzz5qyQufYA14XOLZsXyeDhgkvfPqfLQhZBDcliHdMj7lNAbR2U90CXkw944KeM9EBDokF4SeBRYdyjEavYGCh-d3k2THULD-wKut0tmdHuxbmt6IUO7BGktQUuN3ENMG3ADLrLcdekgBPx4f8YVA6srCwPbRi3WtHaevcazk1Rdp_UZQuN8fGGRchwjTjo29OARwHqI14_qWqEn4cS9OzjCOykzByu1DHfhMlmThGlqdbztO0N_qyihsCIU55YObs2vN1Wiun1cq6l3wiPnn2q8dLgM7WHwg3s56TtfXW6SRdNe2m7TIoc19B7AT8uw__INeQkeUGCD-jXxlRDA1-v2mKodscdnCgimEqZ4aRIQ2n-24oWSchYlzgN6XJhBqRAiAX5T5tnwzfE00c7saNvqYciOoAAAglMHw_sDUt8aDTEVnxRwLn-vNZdIFutOpn7y0MI2w_AWBf7E1ljC9rUCWdipF4iE_9bS8a_UfGbtivNGhZlGMC2gJJ-cu8BfczGP5HhbEsFSl6OW3X4MWfaaNqWZJ6XvzTbwllOxUItFF3UtTmboHbgkW2loqPuhnouRkVOdfkNVQUju5dffhuXa-DaQvWYTEXW4ZKD_F9oZYmR-HbkmfLu3FawmBoqfxEKUd150jTdFfG1tU6ORm1uv1c1np2UXX-eyivhDv2ru_YOboSvLAw-pdG_2WakWN3c-iSlKAZybAukNLAohmXEWUXURwIH43dKPQMcogFBDzVp4y2B4-Sh1QAR10dvr7hPp_V1mKunb9Lj_sp6vVnQ_JC2tD5DIDjdR1xMuh-GxL8be00QZn0sV5ZIHU3BoR0at2MqML2nJ_5xQjN-BI4VVVqBW_wV95fA6v0RHQa6x1FfaW7oQm62kizTYLxOYJuSN2Eczi_F_7ABm_LLyJCsRwmcMTa6U6wa01wFIcp1HMbaVKAxWR_wBzWZiXnM4eeW6Efs1t6M6soCcs06k2Tg7fK7UGYcPCMf_Ro4gzZqtsWHVF-fjA5HpsdDu3BkWLfvnAYSFkG_u4Um0qnO51doPN7FBxhH_yYZ34EYutISZc1sJjr5yK7oI6Z_FuaxRaIvjMczIGVOKmXxvGFlZrCevjD4oQnIVKEIuZ8Tu2xhY2VAuRsKYizQKMRPri3i4P9slsPk-Gpyweq_LVxyp-TPQWUG5oh5n8YOrJQZ5uNQb48PAHLnoCr-eu07vsRKJ_KqlbMhrNHhlA0GWr-KxfGLjy9olg9fYWx23xb9h3-PuYXMzoBduApGjxQCmCoRJRNMEE7517zffSO7SoFm4oomkSQCt-0eWYv70Bx0NsxbrSA4M0w9O1J8g9cTBLixGwQ8g_o3Adnwo7ISbQRmBdfLX2JShINGYYt_qtIoWkG0CLlkA0uudYKWEFnppBLU4ruS2ZMonMrhsHo7b0hMG2IDypGKY8rULhgO5M1DiVjzx6wu31rSG1r6iFSeWWGi_iNDR_uFk&cid=CAQSMgDICaaNKyGpapAQJo_L7HIEdPH07AAs5H9N8p4OGTu2TXrZNT9H-nNoVbPK5FAzSpOSGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffinclan.com%2F&ds=l&xdt=0&iif=1&cor=16187705444291277000&adk=3478109552&idt=146&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 494A 41 KB
13 KB 58ms
58ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50837
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Oct 2024 00:40:58 GMT

GET
H/1.1 200
OK dvbs_src_internal122.js Show response
cdn.doubleverify.com/ Frame 494A 60 KB
20 KB 66ms
64ms Script
application/javascript 2600:1408:7::170f:92b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal122.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=11556288&cmp=28644182&plc=347433751&sid=2742014&aufilter1=3007433&prr=1&ppid=103&autt=1&auevent=ABAjH0jgNYxuqeKi8CF6c3SJkD9g&c1=3007433&auorder=1009120791&aucmp=18464393000&aucrtv=444942797&auxch=38&pltfrm=38&ausite=610283236078&turl=https://finclan.com/&aubndl=&dvregion=0&unit=160x600
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:7::170f:92b Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: b59e0c0d1cf93db01c65f1357aedb1b27cf41998f06af03d1039bb18e83b5f86

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Oct 2023 09:51:46 GMT
Server: UploadServer
ETag: "676309fe6e3823d28d9b38e6462bb025"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19669
Expires: Tue, 15 Oct 2024 14:48:15 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame ABB2 172 KB
60 KB 255ms
59ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Origin: https://finclan.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 74143
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:12:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame ABB2 11 KB
4 KB 92ms
92ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DaNlSI5uLNL0xVKQTnB5uyHp1OYId4ik37iuCKM0_SV8Ix-r49eIX4oROqof1g6eaLTs8QDDrw6eOtJ8svVL-YDKi9pRdJ683Ab24tRj1Luys4YMWSO3BFC2eqf6M9M5COLvuPPfXa2nmBIgKn_gNV58OGTvZJJ9143g34tbUu1QYTOoM&dbm_d=AKAmf-CNRXhKa-s1iakEimDj-w9QqkbZLHKeBy8oiyIx-gAMwHo_z7kvzzCQgbj4Z1Mmu5lJlzaAni6TmcKsqJWWAavvPqMpx4ndv_EsSx8OCyeN1hYH1ThAFSyXpU7MqrIP62_bbPWnF49kix93S-DQ_cabxkGD9GjWVX7yBQbglu3kbmzK8NlGe-6Y4Sz14mlhAJj5Dm9oXqWe6gKLCL_7yNM6O8W5bKdLNvk7d3Qepmsh9o3tX-bf_BS8foXJTdIzZIc3z4LQpS3Evv4A5N6Sh3I4NAQvdpgyPWVQmTaAcmWkSE41uYZa7mAAlYOqZGhtPUfwgIZVuJFUejcZOr3usIArIfNb0h5kaOuyRqsAVKFG9JSd2xrCXXFSnUKwYnIVU7FWnWaC-vOz0JR7IfSKgfkgfrDv6JY05Ohwqjk6w8o2_XnCjwCGRF6XfWHiuBV7Xg5nwJLD7eO77E2Iny0bMFib8ll42-RW18GDiUUqh0OVh1Q1NHqGDlhhLNkiteFNUb4sXjdNo3s7AB4dAOeuee72h1qOCW0M9zwo-on2CKBSEzZnNegNqWBkI5LlyoS85hoqBJXbq4_jnbD9w9webbVjHWEszwd2vDOsO0Y0440z431DR1f9hyDcpehbtw3O8mVtW83UTw4E8YMC5VMkK3ZhReT7t-K6akEGCdyeVr-x349YNGueo8RBmVj_EAN9y8Jeevbc5tde1R6laVQUC5cScOee90qrVFHnfUVRjcPGngadw1ij1whH2t3fkl8brbpYAIugN6jYRrRF2l909sWULEKIXgKz-xHL_KPF-MrXEYiE7a9FHwLdYEmHdxGvvGPXUzUa-Veuqrn9dve_XiqFEduE3icc2_spdhCaV1YOKakQbG_W45ZwM0qrcqCny81hmgpA9Lkx2qFqyR974zK--oOneSgMC2mN9SJYdfWn64j4bFsXMXveKuYS1ZtYXbqhEkXPKTVHS7vWTjGlPm2HkJkG3K-D8m8uyuh7AWkogzLuLhcR4F0pBsmyrP2ZTVb6MnGg6LiEgepeT3pEClJqM2m2JAAC3OYbLpHrFNdSNg1CBQ88oPN8SxhZuRdjwXe6fErE0i1GIyChCzOB1gczBwwab7Udt7JhbxVoD8jtvOXfPtmKHbO_U-obM9v9fL87Rs0UUYKAcv5r8r2hKtGfHi9reLCrbGc2ZuDyNgpZSMVWDBwx6C-k9ptoh6P5l9ZH4A0ASGwAKJ1bgrn95og0l-wPVnfk3TNLUWTZs2jE0dywu0Fr4hdjLV2ifNOt7U5tchjUz-NnVvujZ85qlh_zAVpjQtRYUBUq_PJS7Qp3MFPaCyHVGHtbljsp7WboeNAAccnCt71jyWZoFHyd_cAPU82smPJFan-5Hwg_mjzhzaWht0eFgFZCI4LlbVlkzDxsvn0kFmWt-Bmmr9O35nM6uHS96yQGnR2XZT7fuKX_PVRdVpDBHKLUBG8F5cYTerlD5I5Z2X2WAv4B_lBFVKFc1OvpCGOfZByb8sGRvzuc5bM9-06go1cS3OMU8gPCl1zBpUJcPqqs90avOIOL7Md1V5hguRZeVKT8rLN31Zwsft104dbaQ6lJnfdK65VS-1lMt3hte_nccxRF6vleePOn7o8x1Rx_ZooGrFseR0zchcqn-cItLHx1YAw83Tdp8_GyY7xSw_F1wK5txy-ePNQfhfPMaFJJCLeTSEPcZo4AX6INWu2hWbCtEfnCjKeUpeMN5r2i3utlMS5_u_LlxWOhhNhMODW4KNwnrLmEuqvyjCYj7OhEA_IB15ReADhTR_5bvKgBRKc4GnLlwMHVSzvnQf2rVbWJYCFe6GBItmQcwTBzXSOoMidQh-dOSmE7C2By_Tv5t3PUWlXoXqSpWGRFytrwrzRUyqKhnF7fuRlidRXh2Kg5LexLdVqX2TQKYSE9j85L4HMuG0RpqujwWwy04eBQudkh4HoKRo38xkiGKp8raD15pM1NGX_263s5tPV1G0-AL_lXadvDswrWb5wDjtQdAIcQTfEv8QKL7_DiIrFpEJXZFiseYAPY-ly_v8K6tvnQEobTlA0MyYSvScoxM_aJNbYktKidQMkjhL4G5PXqsa8qznxes_dWGdwSTW9otaezO6rhRJjwTlak3BwQEphcI5f-X3qQOza5qwj-oYFBodmFH9REmseNrasYi0WB_WeN8RsfN6xO_XgtJmOb-3TMQ25WI4o2r5Ctri5q8UUhjUAGrvve3aXy6JLgirh0xthRE-yLj6guIiHgG10FazC41qIP0PLCkBQAvxMudeQgmMY0H2w3YN8nVFDFL0dQS3lDpjRUgyNfL-e9Se-xw32TvOWDl_jyXMSYljkWEsFdIx3ryBc2JDFoqgzq7BEYU24nMvdpp2mJCBEDd2I59HaE4J9YRbBlQ8c5MEe2Rj-cHtcSWtq3WHCBMPZUN7heF2H3tjRfldKxTcEJjraAirvRaXeV--TAt2LwjETLW1vu_r6D0K0ltkgNhhOX5hzJ0YpjAIJcgtoHpSmioM2rd03qtxIHPjg3kQtW_YRuIKUfpKF70h6Ttf94pfCBk2kE1ugnvso2AKkhQXsuhBEfcWEJ5PixcYll_nUvMv6TAL2VZwMDvv8mKDLLK5xz5BVhtsEEc1h8oE0scBlOAlLaOF0KWSkRiafR74GD-N9nEzvHv_RShlE2FaElFwrsnSERtd4lLuC3o3a_tLDss3OHx_TIgqWrscQ9NB1C8y1ifxDe86dJS8sg-QRs79uKHtHIo9gZb-jOpkKGe6-mfp91JmaHJGJCq-xNiNDJ4KLe7M2gI4DC8jzXZ8qATCdSuqJUC8YkvWF-HdiHwSxSnkCaBS0zfxSawUhoABaWdarPN6B5yPpGp8rUi0IpQ0tD9txCTA7fdR44eu6JMbDktZ6PwEYE5PPdTi4ooE2sCP8qtT39JXoHtuuiJ1PvzDtghLi5mxas9DL2HIsAT_PJeEJPAJNbaW6mBO8xiYuwmxS-FtMsIu2TEG8CdnnkcsiqTcxh_scmj2pViV3owrY0-3vY9g2pBspTJX0Y8kXtD-yek7m5VG9OC6pK63oQb23JIhQCdbNbNhmn_TPD2-2NNpcQi5DJBcGYYy2NVfAY3MRbZWrj5BB04ACKfqx0liT5N7m07y5Q63eSpPKTOj5r50C9eh5IHPi_ROaVM0GUQwspeJ7b1NArt42kymK3bH95qxkCtSG38a56GAScEVSpweYzVUcv_RB1HzFn_nZOilxUs93w-ij792Q-q3xsTtRsCtXzrDD4EqyCPhEGi3WtKsY1m8gB0XCUYDL1xkaAssFj4t28sVYOPYacAyvli45Yeu3ARCfeds2ovW9k0DU6sj27e3CaduXBkJg15L31ZH-fZYPMObpvw65o98s96YS67iRt504EKpVAo9jbpcNYgHgF9FHeGRtM35VtDeJxvzfrLkSkAmLO3nwZwiZjI5fuL5KI7NH6L9beOXj_gyZLuS0jlbaMYT6vBfldEy2GVcyYclKT9FJUxnLOlnMhlamK-v0Stl9GGIWytLdXvr9-jjVnR9TEqhACAmUkmuAFAojtU6CYwsJH50WSIqHYLiyndkWr46UdM3_Cz5FgDRWYqkWbLnw0Do282-JBS-gqxUumQuIiXRb40CvDpVRholBBe-Cqm0u_&cid=CAQSMgDICaaNMnmMaCtPGdQC_vwHIPH__R5hyH8WN-J3siKUjBikGiZ2MrQCO5CajtOWDgGmGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Ffinclan.com%2F&ds=l&xdt=0&iif=1&cor=2420274292756573700&adk=3258648037&idt=137&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:10:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:10:23 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame ABB2 30 KB
11 KB 89ms
88ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:17:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73827
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:17:48 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame ABB2 41 KB
13 KB 86ms
86ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50837
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Oct 2024 00:40:58 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame F3EF 37 KB
12 KB 316ms
315ms Document
text/html 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

fda030f0c7189457b70031890badf14715145b2ff6f5cf94bbb3e88a32c1c69e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 12406
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Wed, 18 Oct 2023 14:48:15 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame EC82 22 KB
8 KB 77ms
76ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 184959
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 14 Oct 2023 11:25:36 GMT
expires: Sun, 13 Oct 2024 11:25:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 315 B
169 B 156ms
155ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3403808923739737&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1%7C1x1%7C1x1&ifi=35&didk=1059404481&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467695268&lmt=1697492895&adxs=566&adys=949&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x91&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl7bnQqX_gEv9-jO56ADmV9l9wWY1m6ROZHzTgRy_B2Y_tqrJ_VXVLkJ-fF445wubkihHfacFwPtwtx%2CAOrYGskA6qNRZMhi-pTpAL6DsHw5mw9x1-RuRuf3tvRYjLgbBUf2D2QdP4ngftpLyfWeehFNO9ayeqEa4JG7%2CAOrYGsmmp4BaZWeznIxqXsyRRjQ_-Q19RqzQtKErNOKIT5HuCPFeok3sMO0IIFnu2TrK2J8KsGiZ9_K8vmw5&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D3453499716755464%26eid%3D3453499716755464%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1021%26sap%3D1320%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dfinclan_com-medrectangle-3-3453499716755464%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D217%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D220%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7%2C8%2C9%2C10%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3154%2C3684%2C4184%2C4276%2C7%2C8%2C9%2C10%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7%2C8%2C9%2C10%2C835%26ax_ssid%3D10082%26lb%3D36%26reqt%3D1697467694248&cust_params=amznbid%3D0%26amznp%3D0&adks=735801982&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2d4d0c1af3419a212d115c2ae212e7e6173ca2be46336f0f7966803dc2a54f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 494A 443 B
577 B 381ms
90ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_102492129225&jsTagObjCallback=__tagObject_callback_102492129225&num=6&ctx=11556288&cmp=28644182&plc=347433751&sid=2742014&advid=&adsrv=&unit=160x600&isdvvid=&uid=102492129225&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&brid=3&brver=118&bridua=3&dup=null&ppid=103&auevent=ABAjH0jgNYxuqeKi8CF6c3SJkD9g&aucmp=18464393000&aucrtv=444942797&auorder=1009120791&ausite=610283236078&auxch=38&pltfrm=38&aufilter1=3007433&autt=1&c1=3007433&turl=https://finclan.com/&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=2&htmlmsging=1&tstype=2&prr=1&m1=13&noc=4&fcifrms=23&brh=2&fwc=0&fcl=2408&flt=0&fec=816&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=169&eparams=DC4FC%3Dl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETar9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETar9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3EU42%3FFC%3D9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETau&dvp_exetime=9.30&aubndl=&callbackName=__verify_callback_102492129225
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal122.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 471a16a091eec6d82fe7e24a0eaf3f6902f79e89438c92d73d3ef8284a5788da

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:15 GMT
Content-Encoding: br
X-DV-Response: 0
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 10/15/2023 14:48:15

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 31B9 22 KB
8 KB 59ms
58ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 184959
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 14 Oct 2023 11:25:36 GMT
expires: Sun, 13 Oct 2024 11:25:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 160 B
633 B 367ms
128ms Script
application/javascript 2600:9000:2009:9400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2009:9400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 13:55:27 GMT
via: 1.1 53c349fc522efbb2ef351788548039c0.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD66-C2
age: 3168
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Fri, 14 Oct 2022 00:41:49 GMT
server: AmazonS3
etag: "af15ecfe46737cb2a37226fd060f23a6"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: XrllKKrlc4_z7fYEeqKJZFHugr8QVoi0NyN_UAOizYm_LdKUJC_Xrg==

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2FF0 22 KB
8 KB 61ms
59ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 184959
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 14 Oct 2023 11:25:36 GMT
expires: Sun, 13 Oct 2024 11:25:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 ping
onetag-sys.com/v2/ Frame 8215 0
28 B 69ms
68ms Image
text/plain 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

GET
H2 204 ping
onetag-sys.com/v2/ Frame 8215 0
28 B 44ms
44ms Image
text/plain 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

static.2.86.88.23.clients.your-server.de

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

GET
H3 200 710489.gif
id.rlcdn.com/ Frame F656 42 B
60 B 67ms
66ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/710489.gif
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame BD99 15 KB
6 KB 59ms
59ms Document
text/html 69.192.109.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.109.53 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-109-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=121579
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Wed, 18 Oct 2023 00:34:34 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H2 204 greenoaks.gif
finclan.com/detroitchicago/ 0
16 B 57ms
56ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiJOYU4ifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjgifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjYzODI0MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMzk4OSJ9XX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

POST
H2 204 greenoaks.gif
finclan.com/detroitchicago/ 0
16 B 67ms
66ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjQ5MDQxMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI4In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6Ik5hTiJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiMTYifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjYzODI0MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMzk4OSJ9XX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame EC82 38 KB
14 KB 57ms
57ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:30:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 332244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:30:51 GMT

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame 31B9 38 KB
14 KB 58ms
58ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:30:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 332244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:30:51 GMT

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame 2FF0 38 KB
14 KB 71ms
71ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:30:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 332244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:30:51 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame BD99 2 KB
2 KB 65ms
64ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=96041168&p=159463&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 63b21630868d906cd6ec963b42e3381f2a6f28a237a7fa6bced0e8315527a736

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 16 Oct 2023 14:48:14 GMT
content-length: 1879
content-type: text/html; charset=UTF-8

GET
H3 200 710489.gif
id.rlcdn.com/ Frame F3EF 42 B
60 B 74ms
74ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/710489.gif
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9090 15 KB
6 KB 59ms
59ms Document
text/html 69.192.109.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676955973404692936510273000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUBCB617&prvid=2034%2C2033%2C2031%2C2030%2C2073%2C233%2C157%2C2028%2C2027%2C159%2C2026%2C236%2C2025%2C2069%2C237%2C117%2C238%2C359%2C437%2C97%2C55%2C99%2C56%2C59%2C2045%2C3012%2C2087%2C3010%2C2041%2C241%2C201%2C2039%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C2055%2C2099%2C173%2C294%2C251%2C175%2C450%2C178%2C3018%2C3017%2C214%2C3016%2C413%2C337%2C459%2C339%2C77%2C2022%2C182%2C141%2C262%2C461%2C222%2C223%2C345%2C226%2C468%2C10000%2C80%2C108%2C229%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.109.53 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-109-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=121579
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Wed, 18 Oct 2023 00:34:34 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9FD7
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=841202408762

42 B
288 B

143ms
142ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=841202408762
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=841202408762

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C02B
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
74 B

90ms
88ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 16 Oct 2023 14:48:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Mon, 16 Oct 2023 14:48:16 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 792E
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=oxl-mYqWCjOjalmeME0tZQ

42 B
200 B

65ms
64ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=oxl-mYqWCjOjalmeME0tZQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Mon, 16 Oct 2023 14:48:16 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=oxl-mYqWCjOjalmeME0tZQ
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame CF6C
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=8745238090
https://sync.1rx.io/usersync3/mediamathtest/1508/ba0e652d-4d2d-4200-945f-ae1230ff7d32?zcc=0&sspret=1
https://sync.targeting.unrulymedia.com/csync/RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005

42 B
335 B

151ms
151ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Mon, 16 Oct 2023 14:48:15 GMT
ETag: RX75fe741e953d486fa5b7d27d0cdd23e9005
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-75fe741e-953d-486f-a5b7-d27d0cdd23e9-005
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server: Tengine
Transfer-Encoding: chunked

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame FF12 43 B
369 B 229ms
68ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 4345 43 B
277 B 802ms
150ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Mon, 16 Oct 2023 14:48:16 GMT
Vary: Accept-Encoding
X-adserver-worker: avatar-85cb5c284ed4@version_1.573
X-core-time: 0ms
X-server-arch: v2

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame CDCF 0
0 691ms
259ms Document
text/plain 23.88.86.2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.88.86.2 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

nginx/1.23.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Mon, 16 Oct 2023 14:48:16 GMT
Server: nginx/1.23.1
Strict-Transport-Security: max-age=15768000

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame ECEE
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7507540951290626404&uid=Q750754095129062...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7507540951290626404

42 B
95 B

101ms
100ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7507540951290626404
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 14:48:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=42329
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Mon, 16 Oct 2023 14:48:16 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7507540951290626404
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H2

200

rtset Show response
bh.contextweb.com/bh/ Frame 4F9E
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:C228CB6BDC8E4C60A3FB9543C4F89776&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://ads.servenobid.com/sync?pid=316&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&redirect=https%3A%2F%2Fads.servenobid.com%2Fgetsync%3Fjp%3D6%26redirect%3Dhttps%253A%252F%252Fbh.contextweb.com%252F...
https://ads.servenobid.com/getsync?jp=6&redirect=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D563074%26ev%3D%24UID
https://bh.contextweb.com/bh/rtset?do=add&pid=563074&ev=MzEyOjQzOTY2O*UyMzcxOTQ3!zUy!TB8MzIxOlJYLTc1)mU3!*FlLTk1M2Qt!*g2)i1h!WI3LWQy!2QwY2RkMj!lOS0wM*V8MzE3OjYwOTgx!TMz!zM3O*Y5OTQ4O*l8MzUzOjM0M*Q2O...

49 B
1 KB

126ms
126ms

Document
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=563074&ev=MzEyOjQzOTY2O*UyMzcxOTQ3!zUy!TB8MzIxOlJYLTc1)mU3!*FlLTk1M2Qt!*g2)i1h!WI3LWQy!2QwY2RkMj!lOS0wM*V8MzE3OjYwOTgx!TMz!zM3O*Y5OTQ4O*l8MzUzOjM0M*Q2OTI5MzY1MT(y!zMwM*BWMTB8MzEwOkhmdjRmTFpIcUgxWEJGM*FRb2F1RkJ*!nwzMTY6Q0RFRT(y!zEt!zg3Mi00!0IxLThBRjEt!UV*!jdEO*lBOUU4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

4c23865d180f804df030e56f4d06adfdbefc2e8720b8553596036387e23ab9b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-7ff97786c7-5zsrs
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
amp-access-control-allow-source-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length: 0
content-type: text/html;charset=ISO-8859-1
date: Mon, 16 Oct 2023 14:48:15 GMT
location: https://bh.contextweb.com/bh/rtset?do=add&pid=563074&ev=MzEyOjQzOTY2O*UyMzcxOTQ3!zUy!TB8MzIxOlJYLTc1)mU3!*FlLTk1M2Qt!*g2)i1h!WI3LWQy!2QwY2RkMj!lOS0wM*V8MzE3OjYwOTgx!TMz!zM3O*Y5OTQ4O*l8MzUzOjM0M*Q2OTI5MzY1MT(y!zMwM*BWMTB8MzEwOkhmdjRmTFpIcUgxWEJGM*FRb2F1RkJ*!nwzMTY6Q0RFRT(y!zEt!zg3Mi00!0IxLThBRjEt!UV*!jdEO*lBOUU4

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame 735E 53 B
467 B 145ms
144ms Document
image/gif 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=9&vsid=3404692936510273000V10&type=pba&refUrl=&vid=74676953923404692936510273000V10&ovsid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 53
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Mon, 16 Oct 2023 14:48:15 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

GET
H2

200

insync
thrtle.com/ Frame BD99
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&vxii_pid=12&vxii_pid1=10067&vxii_rcid=cbbd6ef1-e24e-49f8-8a81-186b275a4d7a

43 B
294 B

128ms
128ms

Image
image/gif

3.212.99.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&vxii_pid=12&vxii_pid1=10067&vxii_rcid=cbbd6ef1-e24e-49f8-8a81-186b275a4d7a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Server: 3.212.99.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-99-135.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Mon, 16 Oct 2023 14:48:16 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&vxii_pid=12&vxii_pid1=10067&vxii_rcid=cbbd6ef1-e24e-49f8-8a81-186b275a4d7a
date: Mon, 16 Oct 2023 14:48:15 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame BD99 43 B
61 B 46ms
45ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 Martin
crb.kargo.com/api/v1/dsync/ Frame BD99 43 B
359 B 407ms
178ms Image
image/gif 52.3.77.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.77.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-77-182.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
x-accel-expires: 0
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame BD99 0
425 B 482ms
113ms Image
text/plain 44.205.178.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.205.178.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-178-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Connection: keep-alive
Date: Mon, 16 Oct 2023 14:48:15 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3942 187 KB
59 KB 118ms
117ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/10238320202236180630/ Frame 8E03 104 KB
25 KB 62ms
61ms Document
text/html 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d17fcbff37ba1f219d7886c8b2e56ed2cf39698de180afe9af2e4a1ebcf8dbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Tue, 15 Oct 2024 14:48:15 GMT
last-modified: Fri, 19 Aug 2022 18:11:31 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3942 0
0 384ms
172ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvS4fpIDy_PqhDpnNzUXOGqsPtQiqwQMpNR_Bo8WSQ0abM0QX_eEJBiVi2jQ3yk25Tpz7UYk492fZPN1kyg78zCLWNuqtggzRvXyjHiNBLJpTuqJUd2sGHEw_NrpvvX2VES0S36vlkg4osdDak4m0z4xZiQfboQYA8gTnAVVuL4cZT7uE-q&sai=AMfl-YQNQ0U9Yd6DnF-5Q33bqQuz9timlNUAb2Jt2_NZ-tEsx7yt8byKFgWUQGWOZztPJ80ut64SaC0Sh9ViFu1VN-s2PZRbfmQ1WKKYDAxposTKrEmBiVJi6rBgcSiEvYy5v5Oi&sig=Cg0ArKJSzF9THPKl2_ehEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=490&cbvp=1&cstd=476&cisv=r20231011.55386&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ABB2 187 KB
59 KB 109ms
109ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:15 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/12015261515640113651/ Frame F563 103 KB
25 KB 63ms
62ms Document
text/html 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12015261515640113651/index.html?e=69&leftOffset=0&topOffset=0&c=QSPczbnQcE&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0a79be832aeda685a870f0143273a61f8a656382607f9f1f633a0140877d9f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:15 GMT
expires: Tue, 15 Oct 2024 14:48:15 GMT
last-modified: Fri, 19 Aug 2022 18:11:47 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame ABB2 0
0 369ms
172ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu_Cj_zF24K-DmW1OUXkJxtjmIPZ-7AR0vCB14yHqPiojeaXudbD9I1rn11808jw3hmLd8n1HKBcqWGvQMIQpO2ZGFd_-kkCVy1AWeIrpQdbWIIGG_YSm3QoQy5-izJc59xlotedkU3XM6CJ0jINYm-bIvaTwKumI3oI7O019EI2xzEdyHI&sai=AMfl-YSDHrIQtpIm948MiVzKwHG7QRiOPUyQKM3zWI3tMUn2JcxLATCpZDkoYlUeI_bi2NTcwkHfVLInJCdAbWTxH5Apz3_RPdg4A-oxYFo1n8TTJMesZTpR_Zs4ccFGakp0MyWY&sig=Cg0ArKJSzIhcd5fwzINZEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=478&cbvp=1&cstd=469&cisv=r20231011.72267&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 381 B
173 B 640ms
636ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=409362721726695&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ifi=36&didk=2618578417&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467695713&lmt=1697492895&adxs=566&adys=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x60&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl7bnQqX_gEv9-jO56ADmV9l9wWY1m6ROZHzTgRy_B2Y_tqrJ_VXVLkJ-fF445wubkihHfacFwPtwtx%2CAOrYGskA6qNRZMhi-pTpAL6DsHw5mw9x1-RuRuf3tvRYjLgbBUf2D2QdP4ngftpLyfWeehFNO9ayeqEa4JG7%2CAOrYGsmmp4BaZWeznIxqXsyRRjQ_-Q19RqzQtKErNOKIT5HuCPFeok3sMO0IIFnu2TrK2J8KsGiZ9_K8vmw5&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D7369173194762219%26eid%3D7369173194762219%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1114%26sap%3D1114%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dfinclan_com-box-3-7369173194762219%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D234%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D280%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2764%2C2765%2C3455%2C3456%2C3684%2C4184%2C9%2C10%2C11%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3455%2C3456%2C3684%2C4184%2C7%2C8%2C9%2C10%2C11%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3455%2C3456%2C3684%2C4184%2C4276%2C7%2C8%2C9%2C10%2C11%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3455%2C3456%2C3684%2C3856%2C4184%2C4276%2C7%2C8%2C9%2C10%2C11%2C835%26ax_ssid%3D10082%26lb%3D42%26reqt%3D1697467694582&cust_params=amznbid%3D0%26amznp%3D0&adks=3394468990&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

652aebe006047b78b9b0bcbffa879da7ec0d5784f7035a2e8fa940a35c14b55c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 8E03 118 KB
40 KB 86ms
86ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:28:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:28:57 GMT

GET
H2 200 adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 494A 73 KB
25 KB 428ms
154ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNV6gQK0Sya3tpnTBjcI77iY0Mmf8nPQmpkyY13bWrmimyXNv6M&d=CokBAKAmf-De5xIEorTM9CMAdgaYVN-8aAXhOPfXPz-4JkNEemZaToWlqXn8gA8Dayc5nzuPJV8kgYzU0lJVB2MwLu5SJdBl2pIgDQoEf9DAtHSHT3ko1iNeeVkjQoDO_fH-qvcRZ2vB7LFNS8aYQ5RooI-1c_jx6vwW9ZlutnIU78QndWz-0puJUX0SyQ4AoCZ_4CkfVQ5uTOsc874C_h0MAoTgLgVPwFSJCTAnxr1agVJfjgxf4wAMk-k6cXvM8WxCN3ZVmNvmX6ct8670TyokfEyoYj3d6ilzKrCJ0RWRFJwEjxqPCYda-GW_xQvamzlYWCIXPDEEpqbiY9p-gcTETBASm_UR4pjq142k3Bsp-Pz6_RC4NK9KRqbgngZOqONm2hluqzi5HmGqc6RSxg1vkHuFhCi9WH7gh9L1GW7NANESMx43bj_sTQFzRwYKN0OwH5WpS20Se6Y_YV8NIcbdc889nFb7PAR95ySQ61D07sFcfn9J5Bkt8WsWJrhAue9YMMp7PRi4WRNnlOmKe4prwCo1f2ZoRDVGSjhfKfa5NMROKWIw37wQhN9jJsi28V1eAszcQL5KrKi6DIRd2QHBi3J5NE1G1VCG4a1zFgWrms9UJ7ihhEnzVJodnKELwyG6SzQDy15wSE6Sg0uwpRvsUI44kbq6ZBwss_2cGEPYspk1DSAruudO9GFQD8_vHlEEH-Q6VKw4-4QeCq2w0zolHXtgoiABP29cKmI4HfhhP4TZH1wwUh8v0ksiZACHNd6crUm3Z_beyXH3DOt7jIUDsBRdXE2ijINiQ4yDWsXkHqj09yrG-7EEiqJ_dsXe5F2nU0_jusLTMQfnofW8Al1NCW6zLcvPOvh9vtEjID9sIoQUOskq6CeZ2EaUj27h8y8pIag157T2Ec7n6ypMt5-Yx5Ni985VUX-H6itvRz1uh5jxbwyWEb3swpbvaqZOgiFJJ0DLAMgQk8dQoTO0FNrJNaB7mv1yas_M2ufnmo9a9h1upMMpfMjTPfiGKy3qsp7eLM9PoaDxG_gQ5U3uahMuO6za3ZiUyYmsIPbabHd3TXVAOrweDGaZFeuZszSPEQtH2dhlqozVHepxwQDGZT081SojDSbTeeuhGBpn1a5D2mlSICMWHLf-lQYKntefwpa5hV8ZF-3qZADW1KhRdT8dfCXYtCznvvrKrrBNbFQRc5Pc3IfV0Kk6HwLev_rb3El9QXUASBWegi35m5sAGsVm14y2T8doWhsnqqSzVcO6ol4lGmsfeKA7pUNdohO0Q4p1VZNl5j8913uZy9RupMWckLKmdGDmqaxct5yjrveFcenizoUMBLgfU8wUS5Lwrfm_deRYFWOhW19QunZbKiipYcbcDEgWprE1ZIS3qEnnNDaf1_XC0FtIr-Dykj812vDYJKbQJZKRv_2M8r7WHZLS6rEVfS1_FznmaeCLi0Z6sONcVWnqglSEo_M9LGW0Cf0LhL2vxpAcPYTMtvGNsg87e8Iqt28O5pM4AYzvCI8NpjnlBboMEZcw2Lfy1PFcWp6V40Q5Gc84r-PXoClRXnZ3bID-vBd1pzG_iKlZdnPQ-aSdIoMTjjEs49H3EH21NxzGoiUILw4UPmCpgtYhqA_tbzdSsaAYUAs0_kjQR4MBYUMqgyetIhX5XIZ88ThTJhWyfIweirSSrVgsIJOBEXLKrjxd0r0XZ93LXhIvKgX3jaY4VN_p7KEf5GxitLS8G-nGg-Y8ZkooxWwaXM8Yh3MRd_kYgdQVLzGP6XIoWi47pBP3oJPzpMJjLX1rNzQtw59VcYBCHgkQIciqsvuy9BMHsTjPtqxYjHeASAxvadv3Ptz5WAX5LslzFrYbi5EKRqOp5ylypUbQ1Lg_-x2XN-8ahc0HoOyWvigGIUj1v8kURKLUF0Bh1KPhuFS8HtK5sehaOZ_xjegQnglTK2PITe0Eg3W49b3ODNic_l5kQSfRuBMR_eHx8vedU4sKjVuQIfKsthCag4BRBzFaIVNfxTI9bR43AXNirD7l-HpoYIZzkGbROJ7LrbwNPcT0jLptqZAcOcwUSmuOKvTl69UUtuvvlr02CpKLFIm3iitS9fZkUqS5jAWZbXiUWxa3IMJe_J--07-oJY0JdUqK31cly5GMZ_E3bZDgmMeLauoe_Yj-xk1b090Zb3xTQGqJyryqH658u5ZYfcR3Hd1PEFuJJfq3GSjlkv7IKzY4yYvHOMWIPNAjXq-r4ZxPiMEQN_YkDOLR9JzrJeDQMqZen4Jab9t39sbqkesCmoUceBw7Wjd-x0r67cWj7a-fqCNG7wl4uAmbj2lHpWQUMhBi2inWdVH5Ebe3VTmwjKYC3bowBe_l4E-KEthBz4Z04nRIzoenDGZo5yMYRt9JPlO54Icdwixvx9kLjnp2gw0NrwY29D3E_I1EhpJkAug2pIcF7Sc_JPktBB3bvdjRnJiIdmwevrCamN42hj8mmfnAQQ3ISGBzaC_2oiOJhER5wdWvpcoA0Z81avw5Bi735D0-uyvwbqrFtB1VFrJkKatMz4yK3Qfz4BFulpwiYTMGrvaVyrecsAoZ5F_HaZtx8n48TmGb16A-sHM10Tx9raCaWa8Dem3XhZUvGqTvM54dx4wRB669Wz4Iwi9St41OReWcRWWwjgjHU_OJPC4xAtE-kNv7C8FGXV_BczA0eRo4CAQSMgDICaaNKyGpapAQJo_L7HIEdPH07AAs5H9N8p4OGTu2TXrZNT9H-nNoVbPK5FAzSpOSGAFgAQ

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal122.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

6e0264031042a16a7aab16a94bbaa03a8852f19a4037873ab00d2007843ab145

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25578
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame F563 118 KB
40 KB 76ms
76ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12015261515640113651/index.html?e=69&leftOffset=0&topOffset=0&c=QSPczbnQcE&t=1&renderingType=2&ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12015261515640113651/index.html?e=69&leftOffset=0&topOffset=0&c=QSPczbnQcE&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:28:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:28:57 GMT

GET
H2 200 pixel;r=1674767742;labels=Domain.finclan_com%2CDomainId.152251;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Ffinclan.com%2F;uht=2;fpan=1;fpa=P0-1348388063-1697467695321;pbc=;ns=0;ce=1;qjs=1;qv=44310d19-...
pixel.quantserve.com/ 35 B
210 B 75ms
68ms Image
image/gif 2620:116:800b:21:1456:d0e1:7db4:a56b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1674767742;labels=Domain.finclan_com%2CDomainId.152251;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Ffinclan.com%2F;uht=2;fpan=1;fpa=P0-1348388063-1697467695321;pbc=;ns=0;ce=1;qjs=1;qv=44310d19-20230908150619;cm=;gdpr=0;us_privacy=1---;ref=;d=finclan.com;dst=1;et=1697467695807;tzo=420;ogl=;ses=0ca471fb-6b4f-44e6-9b3f-911594aa3025;mdl=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:1456:d0e1:7db4:a56b , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 66ms
65ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjYyODIzOTUxMDc2MDI1OSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI1ODAzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 37 KB
16 KB 653ms
651ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=4202505654117676&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=37&didk=1483115518&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467695867&lmt=1697492895&adxs=962&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl7bnQqX_gEv9-jO56ADmV9l9wWY1m6ROZHzTgRy_B2Y_tqrJ_VXVLkJ-fF445wubkihHfacFwPtwtx%2CAOrYGskA6qNRZMhi-pTpAL6DsHw5mw9x1-RuRuf3tvRYjLgbBUf2D2QdP4ngftpLyfWeehFNO9ayeqEa4JG7%2CAOrYGsmmp4BaZWeznIxqXsyRRjQ_-Q19RqzQtKErNOKIT5HuCPFeok3sMO0IIFnu2TrK2J8KsGiZ9_K8vmw5&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Db6c98a8bb15764f1c4ee331dcb724178%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D2%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%2C17%2C18%2C19%2C20%2C1428%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3052%2C3053%2C3154%2C3856%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D26%26reqt%3D1697467694759&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209333&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dda80ede211202e12892b0d6d8d61578e8b915fffc7d1ac9b51dbfcbb68d6835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16000
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 50 KB
19 KB 878ms
877ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1982610036248165&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=38&didk=1483115519&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467695873&lmt=1697492895&adxs=638&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl7bnQqX_gEv9-jO56ADmV9l9wWY1m6ROZHzTgRy_B2Y_tqrJ_VXVLkJ-fF445wubkihHfacFwPtwtx%2CAOrYGskA6qNRZMhi-pTpAL6DsHw5mw9x1-RuRuf3tvRYjLgbBUf2D2QdP4ngftpLyfWeehFNO9ayeqEa4JG7%2CAOrYGsmmp4BaZWeznIxqXsyRRjQ_-Q19RqzQtKErNOKIT5HuCPFeok3sMO0IIFnu2TrK2J8KsGiZ9_K8vmw5&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Db6c98a8bb15764f1c4ee331dcb724178%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D2%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%2C17%2C18%2C19%2C20%2C1428%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3052%2C3053%2C3154%2C3856%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D26%26reqt%3D1697467694768&cust_params=amznbid%3D0%26amznp%3D0&adks=1814209332&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa825351966afeb9a37bc0d20238e4b3da7dd6210fd7c7ec2f11888cc7791e0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19303
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 315 B
170 B 204ms
202ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3523890140934306&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1%7C1x1%7C1x1&ifi=39&didk=1059404481&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467695878&lmt=1697492895&adxs=566&adys=949&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x91&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl7bnQqX_gEv9-jO56ADmV9l9wWY1m6ROZHzTgRy_B2Y_tqrJ_VXVLkJ-fF445wubkihHfacFwPtwtx%2CAOrYGskA6qNRZMhi-pTpAL6DsHw5mw9x1-RuRuf3tvRYjLgbBUf2D2QdP4ngftpLyfWeehFNO9ayeqEa4JG7%2CAOrYGsmmp4BaZWeznIxqXsyRRjQ_-Q19RqzQtKErNOKIT5HuCPFeok3sMO0IIFnu2TrK2J8KsGiZ9_K8vmw5&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D3453499716755464%26eid%3D3453499716755464%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1021%26sap%3D1320%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D8%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dfinclan_com-medrectangle-3-3453499716755464%26eb_br%3Dzero%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D217%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D220%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C3684%2C4184%2C9%2C10%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3684%2C4184%2C7%2C8%2C9%2C10%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3154%2C3684%2C4184%2C4276%2C7%2C8%2C9%2C10%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7%2C8%2C9%2C10%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3684%2C3856%2C4184%2C4276%2C7%2C8%2C9%2C10%2C835%26ax_ssid%3D10082%26lb%3D4%26reqt%3D1697467695823%26ss38%3D1%26ss9%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=735801982&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0413f5fd8fd28921e8fff1313cf7006895b364fedb6acf6b90fd17cf75c9275c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 41 KB
17 KB 638ms
638ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=3949812837280788&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=40&didk=2618579448&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467695888&lmt=1697492895&adxs=315&adys=231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=323x250&msz=323x250&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl7bnQqX_gEv9-jO56ADmV9l9wWY1m6ROZHzTgRy_B2Y_tqrJ_VXVLkJ-fF445wubkihHfacFwPtwtx%2CAOrYGskA6qNRZMhi-pTpAL6DsHw5mw9x1-RuRuf3tvRYjLgbBUf2D2QdP4ngftpLyfWeehFNO9ayeqEa4JG7%2CAOrYGsmmp4BaZWeznIxqXsyRRjQ_-Q19RqzQtKErNOKIT5HuCPFeok3sMO0IIFnu2TrK2J8KsGiZ9_K8vmw5&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D4265017896750391%26eid%3D4265017896750391%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1001%26sap%3D1220%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dfinclan_com-box-2-4265017896750391%26eb_br%3Db6c98a8bb15764f1c4ee331dcb724178%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D14%26bvm%3D0%26bvr%3D4%26avc%3D260%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D2%26br2%3D180%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D34%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C143%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C3676%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C20%2C2526%2C2527%2C2761%2C2763%2C2764%2C3154%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%2C17%2C18%2C19%2C20%2C1428%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C3044%2C3045%2C3052%2C3053%2C3154%2C3856%2C4276%2C7%2C8%2C9%2C835%26ax_ssid%3D10082%26lb%3D26%26reqt%3D1697467694758&cust_params=amznbid%3D0%26amznp%3D0&adks=414029443&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a814d51b4b54b392954a56443ede8bb735792a1bd8a508e025749eedffdce153

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17559
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 9090 692 B
948 B 129ms
128ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=81790352&p=159463&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676955973404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 9dea52f1dd8087898786bd81f1dd336fe22ced77f9dfe8325d25ba23efc1beaf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 16 Oct 2023 14:48:15 GMT
content-length: 692
content-type: text/html; charset=UTF-8

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
62 B 132ms
132ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:17 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 2501 692 B
941 B 176ms
175ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=14111552&p=156983&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 9dea52f1dd8087898786bd81f1dd336fe22ced77f9dfe8325d25ba23efc1beaf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 16 Oct 2023 14:48:14 GMT
content-length: 692
content-type: text/html; charset=UTF-8

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 107ms
107ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5NjcsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

GET
H3 200 aspira_heavy.woff
s0.2mdn.net/sadbundle/10238320202236180630/ Frame 8E03 48 KB
48 KB 102ms
102ms Font
font/woff 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10238320202236180630/aspira_heavy.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed9d26bb70cd13054b952651e6cc9e02584c4078969248c36ed93f1b149e05e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:39:34 GMT
x-content-type-options: nosniff
age: 331722
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49012
x-xss-protection: 0
last-modified: Fri, 19 Aug 2022 18:11:31 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:39:34 GMT

GET
H3 200 aspira_demi.woff
s0.2mdn.net/sadbundle/10238320202236180630/ Frame 8E03 48 KB
48 KB 108ms
108ms Font
font/woff 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10238320202236180630/aspira_demi.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1909e43b441d4d1bb577d9c0d50524b04c9a2bbd35073b04f921147d0490204a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:39:34 GMT
x-content-type-options: nosniff
age: 331722
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48676
x-xss-protection: 0
last-modified: Fri, 19 Aug 2022 18:11:31 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:39:34 GMT

GET
H3 200 aspira_heavy.woff
s0.2mdn.net/sadbundle/12015261515640113651/ Frame F563 48 KB
48 KB 149ms
149ms Font
font/woff 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12015261515640113651/aspira_heavy.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12015261515640113651/index.html?e=69&leftOffset=0&topOffset=0&c=QSPczbnQcE&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed9d26bb70cd13054b952651e6cc9e02584c4078969248c36ed93f1b149e05e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12015261515640113651/index.html?e=69&leftOffset=0&topOffset=0&c=QSPczbnQcE&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:20:44 GMT
x-content-type-options: nosniff
age: 332852
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49012
x-xss-protection: 0
last-modified: Fri, 19 Aug 2022 18:11:47 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:20:44 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 31B9 0
20 B 196ms
195ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bl5oGL00tZeOxCIesoPMPiv-riAoAAAAAOAHgBAI&bg=!MTKlMn3NAAYMG8UMLBs7ADQBe5WfOEpl6OlLBrzknUd9PrO1bPP23884crt_BYW0n1ouAJT42dnJgqY-2rz_hPytymtPAgAAAhdSAAAABWgBB5kC1DggdHH5l59d3IcE8BZp0PLDkBjiv19crHtA2hrNxz_7b3URzMBYqvXAqyNS2x_2Evu-RGIlv78jzHn4XZfcuRRxuDCg3_i7ehrpHE0q0svrHViHpsyWQelWhAGFOkrLNhHFbDgwHeslY6Klr3sg7mGooDU0Aq0AVNZBlBwFOJ1gusOAL1O5r8ElBos54oIkhi4tMAaM5CcVkUDsaH8ywJfUcYUQoVr0fc-BTsw6wkXpVepyeIMq6gmDzdi8nHFDm6TTU8xXQwkli1O5KDhKW5IEDmDmAXJbjYvURedsamaEmv9p7E3crzOcMwB9hOaj0fdnSNFtaUibQlV5SZOX2X4KShyde1ct_8HP6EEMdr8UfToBdzAjeRp9a5gddgBtKNOi3fooFOxOqvDTldg7YHjUpMdhHqUDnpkPMkL0NDtPbLE2ozn3_jbGuZXFlaQbYdHvLbNzgGvdtmT3f8YjJw4JRP8276J5ufR-o2UPiANMjp-8CXLd7URgWdn9_CGQym5EGJYyXc6JoV1wwEdbopaWedONUnKHvhKUKVrcGq0jxT7YTUJLoqvloPrEXXEpbGNiusuWBs_mPce8j2MM6TegLTIhraPK-zqhRcAhr1oiq1FXgVb8yBD3VWLeT_fY43vlnZ0ZiySBnbRmb_RwhQOtovz93xoeL5lLwaOqr9aK8H1-sHaFr77aIFAi_xWz47Kzh-T6ewu6sTHjSc3D_Dg8tMGJJM2J00ATKwqrRIoh26IqvrgCfoYQ221nVtCjGRMOISlPe-jMufRdF26DSPPPv-7o08Eq4g-IZYxc9EdR_vDdKyEH6HzXcuIfZThg4jpOT2vBNW1uG7-KAq6TKZwuPvazm5WKBJKu2r7lHHz--TcYz5rxjS16deIQQ6CYhfwlslK4n87ZxwJ5l6IMzw4ICfRMDSrLXZzS2pRmFAAoZJ1aJdPLV4KSwUVP9cNcEOATDlM

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EC82 0
20 B 190ms
189ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3wwEL00tZZzPBMjvzwXku7T4DAAAAAA4AeAEAg&bg=!t7SltPvNAAYMG8UMLBs7ADQBe5WfOOHO8FkzKXwN9J3BONfpyNmfn5ljJGPl45-DgV_Wu_kR0bPr1MT1aI-VifYK8DR7AgAAAjFSAAAABWgBB5kC4EO_IO_rPdGnUWRXeoD5PTsbOl_oBwhBWsL138DmI8f_PeEUj-uWhVKMMRcDQ_thloIq72OZCzcvVy1mF_7vgMGdxCIH6rmhL6VWiECQDvpqhig-ijcXCs6DAlVf91xSNC2TvoQvwVwbGC1UwNyO7szDAwd65zcdkeMHw5fucZb3RVfzuhJMZqw2hBWBuKnJU3gv31HS5ulQpt-FweXQReyoGpQKBNhSJf9IjuDd4wnXmn1ZdBlUzr71loK0GvN4Zg_UbbFfd33VSFWRs8FxqFyURokyvYqllc4cFCFURzl4ws6KIRn3ElnMMvHfVHARFuVU5GvQUvHtPiqeGwv9oinzpSBxIgFc-04fckXmzrU9LHkIHCa00hnNRz22z1H2GZo-6QdmA_s4NsB7JFtA_pRsVGjXOjtMBvejsZEhVvzvAuhZrwjQX4a5wblWf__ShoRB49Gddex7YbjJRpx0mIO3iuOyuboqT1fR2RgoIABp4x4tXNYdDvkZlvkp6rUwt4vpQFIaUW7QWJ_hGtc0pIi-r7Zu-I2YEA6f_AS95MUrNmuzMc2JlEH02d0u8WG8o_cCMFARLeRzIXnb_j73BwcV4-BcDGtZpDuyj4t9_4llJJJBG1orkIHpVb-i5gMYc2unj652vyu8PG7PAF5XhQ3oYhucPSkHm59WlRB64GU5ufi3ivbApAiaznK_b7CemDAtWi51C3_yAtvRTn4IG3NAsuXb_GAV3ge1lOsD83vMqIPtKz8CQRAeLppBeW7428ptqqjWy0kf6Qb790lkeahUeYLjAv2LOANUggyBuXnFGI16bnpCozmdGTmX_xK90J5b8qHW6VMYfFoVsxsgPFwDUeU8hY0zpURyf9_4F3AAFIZAIHIQhQ0xfP2RubTAIzjyfi15D8LhyAetYmQMk3b3Emj8MNj2euuLcyYOKPxyIVezyOp04HQUL9BQYfGY8dWQNeUewgH7EfTrXXSBsX4

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 65ms
65ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzQ1MzQ5OTcxNjc1NTQ2NCIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjEwMjEsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjYifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

GET
H3 200 fetch Show response
go.ezodn.com/ads/charity/ 12 B
594 B 183ms
182ms XHR
application/json 2606:4700:e2::ac40:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/ads/charity/fetch?country=CA&size=320x50&state=ON
Requested by: Host: finclan.com
URL: https://finclan.com/detroitchicago/augusta.js?cb=43
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 361167c7a6b11b017819cdba0f3f0fbdbfa2b199cd2d2450a4c2cc1c446a2120

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 12
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://finclan.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SSBcuc9Z8139fk4sqB%2BPTu9TZeU6a1RRZnxKEsGlgJIIkNMSbCGwfEY%2FfZTIExp%2FdPxCZtyW5Q3wqeY0gfDphX%2BCDVfgANWHDo2%2FmONFenUlrj0cMmWP2wivRdGl15KRZvAMC2rGe01z15o%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=86400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
cf-ray: 81711a0d087f29a0-ORD
access-control-allow-headers: Content-Type

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame 47B1 53 B
467 B 212ms
210ms Document
image/gif 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=9&vsid=3404692936510273000V10&type=pba&refUrl=&vid=74676955973404692936510273000V10&ovsid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 53
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:16 GMT
expires: Mon, 16 Oct 2023 14:48:16 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

GET
H/1.1 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 9090 0
397 B 904ms
231ms Image
text/plain 52.19.113.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.113.29 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-113-29.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:16 GMT
X-Clacks-Overhead: GNU Terry Pratchett
X-Adswizz-request-id: fa450367-78e8-4e9a-92cb-fd570ff65c8c
Connection: keep-alive
Content-Length: 0
X-Application-Context: application:production
Instance-id: i-099b71cbf181ef840

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 9090
Redirect Chain

https://idsync.rlcdn.com/712188.gif?partner_uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd3846b0-852d-4d7f-a6be-273a9a7c3889

42 B
60 B

90ms
89ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd3846b0-852d-4d7f-a6be-273a9a7c3889
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd3846b0-852d-4d7f-a6be-273a9a7c3889
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8/gdpr=0/ Frame 9090 49 B
265 B 67ms
66ms Image
image/gif 34.233.138.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8/gdpr=0/gdpr_consent=
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.138.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-138-61.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.13.159
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 9090 95 B
124 B 77ms
76ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2FF0 0
20 B 184ms
183ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZwCOL00tZb3aB6bJ_gT0_bDACwAAAAA4AeAEAg&bg=!zM-lz4DNAAYMG8UMLBs7ADQBe5WfOKqOj17zLjgiDnK8UUqzlrCIBm4FRd2EgCdt8Q-xDtufhoJrI_YLJb1MF6PPMNiUAgAAAhVSAAAABWgBB5kC3nZ6EgxAluaRavqVeoOFge-KOME5lDqPX2J0CwijOPt21VP6RYWVTKtZsSBUmRh14gobVbdP8gohMZmvQlcE02tvGut-Pql9wVhucsHIsvKfMLSqcS7A6XdrTEwXuPANyMn-bSDPVOmC7Mi9s2Sk0lhvJTKO8tpermxOM0JjBKEgDdXfaaboBBWM_iFaQI4jwDSpKRiqa4MLYvQhqPgfd0RnlQcC_AjJezfb4ErdBGnjCESsVLztaABKapX2c0Asr_h5r1_FWgiD5_MfeIh6dAQ3ItkjmAZbuWAAoZmsiXMuTCSm2hntvIPNHPL3qjICFjf4SdbmDsB_Wr-ws7VVrjsec_K-L-IWKoNRerekpXqAhQJRyda92gaosKTypn0D4u9iHmAlBR92CLA7KuctImKKLVzpl6jL7DRJyI8FtaM14-gqgL-eOiTpJ5k0tk4iGUpsWecvf4DsAyvlv3EMiLsugAUTFUBdlwj1ZBVpEDoqtCnaKy5d_0ZUWCxKnoxt5s3jfkH7sS1nBkbnnZmEtNAwmvlFk2TuvsPplO2tfFFbpxAXLpK_nN3hjoi_oRwgSxhzo8H_4vENT34uOObvHBBP1qOktpSo_MUIGm4DchjlAZ47LcFj_tq8V142qWEoQJKK2Wr3KKWk4y9JvtHvovyvEm9u9R02cmkePOBBavVjrCgaMQBBdiPdoJFqQ3OOD4jk00t1nRbXmCoScqJ3ixocm8j0Qon8sLKb44g0KI6ycL_fauoOMrEGoh6G8shEzCXZ_Ssxw95JT4lAhVExsVZFAxOU8g_KTFPZ6BTXW6XA686BQvdbnAAZrmLM24_XDTIX3kZG-nyAQmT0vwd_SamDZ7ghjKSvXSgjvgA6KBEV6is3UcKfeMC10BDXSv3sCj2PT_Hl7Mk72heceWoPJMVyMkUbXgEdVo0jtGHv7qg_EJIBB7fkfAxfrOICvhbZe_Zq0Quca7syqf83-TEX

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 8E03 7 KB
6 KB 77ms
76ms XHR
application/json 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0780b2fc76a7f8fcd697644ed711dc7774b51f18ec1666a144b59605241b0580

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5792
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame F563 7 KB
6 KB 166ms
165ms XHR
application/json 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68abe5258f3ddfc31b6f095560367c6da6c33f72bb166c34726a9142d931fa9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5760
x-xss-protection: 0

GET
H/1.1 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 2501 0
397 B 800ms
170ms Image
text/plain 52.19.113.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.113.29 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-113-29.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:15 GMT
X-Clacks-Overhead: GNU Terry Pratchett
X-Adswizz-request-id: 38068574-70bf-43e6-9345-7147752d6667
Connection: keep-alive
Content-Length: 0
X-Application-Context: application:production
Instance-id: i-000a9cddd7f93e2ce

GET
H3

200

362588.gif
idsync.rlcdn.com/ Frame 2501
Redirect Chain

https://idsync.rlcdn.com/712188.gif?partner_uid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1
https://idsync.rlcdn.com/362588.gif?partner_uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1

42 B
60 B

89ms
88ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362588.gif?partner_uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/362588.gif?partner_uid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1
date: Mon, 16 Oct 2023 14:48:16 GMT
server: Kestrel
content-length: 199

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8/gdpr=0/ Frame 2501 49 B
265 B 83ms
82ms Image
image/gif 34.233.138.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8/gdpr=0/gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.138.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-138-61.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.11.160
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 2501 95 B
124 B 77ms
76ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H2 200 log
hblg.media.net/ Frame DF3C 35 B
191 B 63ms
62ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=adpvlog&__q=Ae4FMgCAjAQAAACAAAAAgAEAAAAIAAAEAAEAAAAAAgEEAAAAAAAAAAAAAAAAAAxQ_ARAMTcxZGZlYzJlMzFjNzIyM2IxOTljMjk1N2UyMDE1OTn-wZS0AZYDBENBFmZpbmNsYW4uY29tEjhDVUJDQjYxNz5kaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wDjE2MHg2MDAOZWFzdF9zYwQyMwxQUkVCSUQSOFBSTDRFN04zBDE2AD5kaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wAjA8cnRiLWNvbW1vbi01NmRmZmY5NGY5LWhiZGRqLlNDAjAABgAwZ2VuLXZibHRfcHJlYmlkX3Rlc3RfMl8xRjIwMjMxMDE1MjAzNl9nZW4tdmJsdF9wcmViaWRfdGVzdF8yJmdlbi12Ymx0X3ByZWJpZF9hbGyiASRNRURJQS5ORVQgRVhDSEFOR0UCAmQ&evttyp=1

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 16 Oct 2023 14:48:16 GMT

GET
H2 200 log
hblg.media.net/ Frame C8D7 35 B
191 B 91ms
91ms Image
image/gif 23.56.220.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=adpvlog&__q=Ae4FMgCAjAQAAACAAAAAgAEAAAAIAAAEAAEAAAAAAgEEAAAAAAAAAAAAAAAAAAxQ_ARAMGUxODJkYTYxY2E1OTJhMmVmODQzMGUxMjkyMjZiMWP-wZS0AZYDBENBFmZpbmNsYW4uY29tEjhDVUJDQjYxN05kaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAMNzI4eDkwDmVhc3Rfc2MEMjMMUFJFQklEEjhQUkw0RTdOMwQxNgBOZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1tZWRyZWN0YW5nbGUtMi0wAjA8cnRiLWNvbW1vbi01NmRmZmY5NGY5LWhiZGRqLlNDAjAABgAwZ2VuLXZibHRfcHJlYmlkX3Rlc3RfMl8xRjIwMjMxMDE1MjAzNl9nZW4tdmJsdF9wcmViaWRfdGVzdF8yJmdlbi12Ymx0X3ByZWJpZF9hbGyiASRNRURJQS5ORVQgRVhDSEFOR0UCAmQ&evttyp=1

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.220.66 Eden Prairie, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:16 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 16 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 157ms
155ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjYyODIzOTUxMDc2MDI1OSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI1ODAzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMTYwLDYwMF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjI2MjgyMzk1MTA3NjAyNTkiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNTgwMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyNjI4MjM5NTEwNzYwMjU5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTk3NiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjU4MDMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:17 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 494A 172 KB
60 KB 130ms
130ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Origin: https://finclan.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:12:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 74144
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:12:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/ Frame 494A 11 KB
4 KB 121ms
121ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/omrhp.js

Requested by

Host: bid.g.doubleclick.net
URL: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNV6gQK0Sya3tpnTBjcI77iY0Mmf8nPQmpkyY13bWrmimyXNv6M&d=CokBAKAmf-De5xIEorTM9CMAdgaYVN-8aAXhOPfXPz-4JkNEemZaToWlqXn8gA8Dayc5nzuPJV8kgYzU0lJVB2MwLu5SJdBl2pIgDQoEf9DAtHSHT3ko1iNeeVkjQoDO_fH-qvcRZ2vB7LFNS8aYQ5RooI-1c_jx6vwW9ZlutnIU78QndWz-0puJUX0SyQ4AoCZ_4CkfVQ5uTOsc874C_h0MAoTgLgVPwFSJCTAnxr1agVJfjgxf4wAMk-k6cXvM8WxCN3ZVmNvmX6ct8670TyokfEyoYj3d6ilzKrCJ0RWRFJwEjxqPCYda-GW_xQvamzlYWCIXPDEEpqbiY9p-gcTETBASm_UR4pjq142k3Bsp-Pz6_RC4NK9KRqbgngZOqONm2hluqzi5HmGqc6RSxg1vkHuFhCi9WH7gh9L1GW7NANESMx43bj_sTQFzRwYKN0OwH5WpS20Se6Y_YV8NIcbdc889nFb7PAR95ySQ61D07sFcfn9J5Bkt8WsWJrhAue9YMMp7PRi4WRNnlOmKe4prwCo1f2ZoRDVGSjhfKfa5NMROKWIw37wQhN9jJsi28V1eAszcQL5KrKi6DIRd2QHBi3J5NE1G1VCG4a1zFgWrms9UJ7ihhEnzVJodnKELwyG6SzQDy15wSE6Sg0uwpRvsUI44kbq6ZBwss_2cGEPYspk1DSAruudO9GFQD8_vHlEEH-Q6VKw4-4QeCq2w0zolHXtgoiABP29cKmI4HfhhP4TZH1wwUh8v0ksiZACHNd6crUm3Z_beyXH3DOt7jIUDsBRdXE2ijINiQ4yDWsXkHqj09yrG-7EEiqJ_dsXe5F2nU0_jusLTMQfnofW8Al1NCW6zLcvPOvh9vtEjID9sIoQUOskq6CeZ2EaUj27h8y8pIag157T2Ec7n6ypMt5-Yx5Ni985VUX-H6itvRz1uh5jxbwyWEb3swpbvaqZOgiFJJ0DLAMgQk8dQoTO0FNrJNaB7mv1yas_M2ufnmo9a9h1upMMpfMjTPfiGKy3qsp7eLM9PoaDxG_gQ5U3uahMuO6za3ZiUyYmsIPbabHd3TXVAOrweDGaZFeuZszSPEQtH2dhlqozVHepxwQDGZT081SojDSbTeeuhGBpn1a5D2mlSICMWHLf-lQYKntefwpa5hV8ZF-3qZADW1KhRdT8dfCXYtCznvvrKrrBNbFQRc5Pc3IfV0Kk6HwLev_rb3El9QXUASBWegi35m5sAGsVm14y2T8doWhsnqqSzVcO6ol4lGmsfeKA7pUNdohO0Q4p1VZNl5j8913uZy9RupMWckLKmdGDmqaxct5yjrveFcenizoUMBLgfU8wUS5Lwrfm_deRYFWOhW19QunZbKiipYcbcDEgWprE1ZIS3qEnnNDaf1_XC0FtIr-Dykj812vDYJKbQJZKRv_2M8r7WHZLS6rEVfS1_FznmaeCLi0Z6sONcVWnqglSEo_M9LGW0Cf0LhL2vxpAcPYTMtvGNsg87e8Iqt28O5pM4AYzvCI8NpjnlBboMEZcw2Lfy1PFcWp6V40Q5Gc84r-PXoClRXnZ3bID-vBd1pzG_iKlZdnPQ-aSdIoMTjjEs49H3EH21NxzGoiUILw4UPmCpgtYhqA_tbzdSsaAYUAs0_kjQR4MBYUMqgyetIhX5XIZ88ThTJhWyfIweirSSrVgsIJOBEXLKrjxd0r0XZ93LXhIvKgX3jaY4VN_p7KEf5GxitLS8G-nGg-Y8ZkooxWwaXM8Yh3MRd_kYgdQVLzGP6XIoWi47pBP3oJPzpMJjLX1rNzQtw59VcYBCHgkQIciqsvuy9BMHsTjPtqxYjHeASAxvadv3Ptz5WAX5LslzFrYbi5EKRqOp5ylypUbQ1Lg_-x2XN-8ahc0HoOyWvigGIUj1v8kURKLUF0Bh1KPhuFS8HtK5sehaOZ_xjegQnglTK2PITe0Eg3W49b3ODNic_l5kQSfRuBMR_eHx8vedU4sKjVuQIfKsthCag4BRBzFaIVNfxTI9bR43AXNirD7l-HpoYIZzkGbROJ7LrbwNPcT0jLptqZAcOcwUSmuOKvTl69UUtuvvlr02CpKLFIm3iitS9fZkUqS5jAWZbXiUWxa3IMJe_J--07-oJY0JdUqK31cly5GMZ_E3bZDgmMeLauoe_Yj-xk1b090Zb3xTQGqJyryqH658u5ZYfcR3Hd1PEFuJJfq3GSjlkv7IKzY4yYvHOMWIPNAjXq-r4ZxPiMEQN_YkDOLR9JzrJeDQMqZen4Jab9t39sbqkesCmoUceBw7Wjd-x0r67cWj7a-fqCNG7wl4uAmbj2lHpWQUMhBi2inWdVH5Ebe3VTmwjKYC3bowBe_l4E-KEthBz4Z04nRIzoenDGZo5yMYRt9JPlO54Icdwixvx9kLjnp2gw0NrwY29D3E_I1EhpJkAug2pIcF7Sc_JPktBB3bvdjRnJiIdmwevrCamN42hj8mmfnAQQ3ISGBzaC_2oiOJhER5wdWvpcoA0Z81avw5Bi735D0-uyvwbqrFtB1VFrJkKatMz4yK3Qfz4BFulpwiYTMGrvaVyrecsAoZ5F_HaZtx8n48TmGb16A-sHM10Tx9raCaWa8Dem3XhZUvGqTvM54dx4wRB669Wz4Iwi9St41OReWcRWWwjgjHU_OJPC4xAtE-kNv7C8FGXV_BczA0eRo4CAQSMgDICaaNKyGpapAQJo_L7HIEdPH07AAs5H9N8p4OGTu2TXrZNT9H-nNoVbPK5FAzSpOSGAFgAQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 15:10:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85052
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 15:10:44 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/ Frame 494A 30 KB
11 KB 121ms
121ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4fcc2c45e5c8be67198b1d2c38bef90e3373e59b91be75e915711bfa7c10d22a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:25:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11602
x-xss-protection: 0
server: cafe
etag: 2362517075893974484
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:25:38 GMT

GET
H/1.1 200
OK dv-measurements4811.js Show response
cdn.doubleverify.com/ Frame 0BF3 420 KB
99 KB 79ms
78ms Script
application/javascript 2600:1408:7::170f:92b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements4811.js
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:7::170f:92b Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 54113dd8fdf18f022bde7e56df7a9b269a4843193eb9e5d3a399ec91344b1406

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:16 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 06:45:20 GMT
Server: UploadServer
ETag: "76101838a30d4647fcfee7956dd3d6ce"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 101041
Expires: Tue, 15 Oct 2024 14:48:16 GMT

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame 1407 53 B
467 B 194ms
194ms Document
image/gif 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=pba&refUrl=&vid=74676931033404692936510273000V10&ovsid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676931033404692936510273000V10%26ovsid%3DPM_UID

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 53
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:16 GMT
expires: Mon, 16 Oct 2023 14:48:16 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 146ms
146ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA2Mjc0OTYxMjc1NTMyMiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMTYwLDYwMF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNjI3NDk2MTI3NTUzMjIiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk4OCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MDYyNzQ5NjEyNzU1MzIyIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTk3NSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5ODgsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:15 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:15 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 107ms
104ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODgzMTEyMjk4NDgxMjcxNiIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5NjcsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils5NzAsOTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4ODMxMTIyOTg0ODEyNzE2IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk2NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4ODMxMTIyOTg0ODEyNzE2IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk2NywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiI1NyJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame 4DF4 53 B
467 B 186ms
185ms Document
image/gif 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3404692936510273000V10&type=pba&refUrl=&vid=74676931033404692936510273000V10&ovsid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676931033404692936510273000V10%26ovsid%3DPM_UID

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 53
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:16 GMT
expires: Mon, 16 Oct 2023 14:48:16 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 78 KB
26 KB 860ms
859ms XHR
text/plain 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4285497030006294&correlator=1611372275454254&eid=31078769%2C31078659&output=ldjh&gdfp_req=1&vrg=202310110101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22516421184%2Cfinclan_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ifi=41&didk=2618578417&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3D4f3fb2a58321340d%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MboPjwIBFEkVvHMqKa8z4XlXmymEw&gpic=UID%3D00000d9a18a950a6%3AT%3D1697467689%3ART%3D1697467689%3AS%3DALNI_MaCWjSbuqAu4aQDHFdOEKxL5G0TPg&abxe=1&dt=1697467696371&lmt=1697492896&adxs=566&adys=1092&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Ffinclan.com%2F&vis=1&psz=1110x60&msz=468x60&fws=4&ohw=1600&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsl7bnQqX_gEv9-jO56ADmV9l9wWY1m6ROZHzTgRy_B2Y_tqrJ_VXVLkJ-fF445wubkihHfacFwPtwtx%2CAOrYGskA6qNRZMhi-pTpAL6DsHw5mw9x1-RuRuf3tvRYjLgbBUf2D2QdP4ngftpLyfWeehFNO9ayeqEa4JG7%2CAOrYGsmmp4BaZWeznIxqXsyRRjQ_-Q19RqzQtKErNOKIT5HuCPFeok3sMO0IIFnu2TrK2J8KsGiZ9_K8vmw5&ga_vid=283721564.1697467689&ga_sid=1697467689&ga_hid=1288998357&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRj_yNXHszFIAFICCGQSGAoJeWFob28uY29tGOXL1cezMUgAUgIIahIZCgp1aWRhcGkuY29tGP7I1cezMUgAUgIIZBIbCgxpZDUtc3luYy5jb20YkNDVx7MxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiDztXHszFIABIZCgpwdWJjaWQub3JnGPzL1cezMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj_yNXHszFIAFICCGQSFwoIcnRiaG91c2UY6cvVx7MxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVV6RkpSMm9yU0hSU1QybHFSVmM0YUhnNFFuRnlRVDA5SW4wPRicz9XHszFIAA..&dlt=1697467687435&idt=605&prev_scp=a%3D%257C0%257C%26iid1%3D7369173194762219%26eid%3D7369173194762219%26t%3D134%26d%3D152251%26t1%3D134%26pvc%3D0%26ap%3D1114%26sap%3D1114%26as%3Drevenue%26plat%3D1%26bra%3Dmod233-c%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D7%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dfinclan_com-box-3-7369173194762219%26eb_br%3Dzero%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D4%26bvm%3D0%26bvr%3D4%26avc%3D234%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D280%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C193%2C142%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2339%2C3054%2C3430%2C3457%2C3458%2C3460%2C3682%2C3683%2C4185%2C4186%2C5747%2C3676%2C12%2C13%2C14%2C15%2C16%2C20%2C2310%2C2526%2C2527%2C2764%2C2765%2C3455%2C3456%2C3684%2C4184%2C9%2C10%2C11%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C3455%2C3456%2C3684%2C4184%2C7%2C8%2C9%2C10%2C11%2C835%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3154%2C3455%2C3456%2C3684%2C4184%2C4276%2C7%2C8%2C9%2C10%2C11%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3455%2C3456%2C3684%2C3856%2C4184%2C4276%2C7%2C8%2C9%2C10%2C11%2C835%2C17%2C18%2C19%2C20%2C1428%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3154%2C3455%2C3456%2C3684%2C3856%2C4184%2C4276%2C7%2C8%2C9%2C10%2C11%2C835%26ax_ssid%3D10082%26lb%3D4%26reqt%3D1697467696365%26ss38%3D1%26ss9%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=3394468990&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3da0667e62acabf3abeb5a036a1dbffa6eea194a59b43d0099a364a1436c53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26317
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://finclan.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 8E03 17 KB
6 KB 59ms
58ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 16 Oct 2023 14:48:16 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3942 0
0 119ms
118ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvS4fpIDy_PqhDpnNzUXOGqsPtQiqwQMpNR_Bo8WSQ0abM0QX_eEJBiVi2jQ3yk25Tpz7UYk492fZPN1kyg78zCLWNuqtggzRvXyjHiNBLJpTuqJUd2sGHEw_NrpvvX2VES0S36vlkg4osdDak4m0z4xZiQfboQYA8gTnAVVuL4cZT7uE-q&sai=AMfl-YQNQ0U9Yd6DnF-5Q33bqQuz9timlNUAb2Jt2_NZ-tEsx7yt8byKFgWUQGWOZztPJ80ut64SaC0Sh9ViFu1VN-s2PZRbfmQ1WKKYDAxposTKrEmBiVJi6rBgcSiEvYy5v5Oi&sig=Cg0ArKJSzF9THPKl2_ehEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1191&vt=11&dtpt=701&dett=3&cstd=476&cisv=r20231011.55386&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/18330211981522502853/ Frame 9965 117 KB
32 KB 60ms
59ms Document
text/html 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71e9a1ec01e395b96eddc6ea090a874dbd5781023223577f3fec980b3ce1c8e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:16 GMT
expires: Tue, 15 Oct 2024 14:48:16 GMT
last-modified: Tue, 08 Aug 2023 17:04:48 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 494A 0
0 129ms
128ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstttqFgKd9w3FT88yZI0rjDTgCuyBkqGAjiEjxqyLsh0xFLTKPSDsCSjDrsDV1qHuQCAsmMTxwlW2juJQ1G60_d-MOlUN3AkUuDAoRsOGTpg5fB2l_I6sFoFtJIE6VmBK8BzhZ99OtZ-xikL_bpydA7UYcX-kWPxIqxXnkpizTra3HmfiF-dN41FMRNSKnR9WW_rdrOo63uUjGDnNGCgMlZDAKzPfVj&sai=AMfl-YSMJ13VlMQAh1SMmBfkFotl-0sScyroGRf8UA1EnltAdzMvofDRSuSuc9u_F_51i58MFwC182PxaSMS8iMqcVmm4ob4tO26bFwLvAN_WpeHpkhq7GR66Leqc4Uuq3UmMIa1fkc7JbsV131FBzxTu609_r79Hrw&sig=Cg0ArKJSzJwpD6j7rBwCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=176&cbvp=1&cstd=165&cisv=r20231004.97087&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK dv-measurements4811.js Show response
cdn.doubleverify.com/ Frame 30A3 420 KB
99 KB 63ms
62ms Script
application/javascript 2600:1408:7::170f:92b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements4811.js
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:7::170f:92b Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 54113dd8fdf18f022bde7e56df7a9b269a4843193eb9e5d3a399ec91344b1406

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:16 GMT
Content-Encoding: gzip
Last-Modified: Sun, 15 Oct 2023 06:45:20 GMT
Server: UploadServer
ETag: "76101838a30d4647fcfee7956dd3d6ce"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 101041
Expires: Tue, 15 Oct 2024 14:48:16 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame F563 17 KB
6 KB 61ms
61ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 16 Oct 2023 14:48:16 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame ABB2 0
0 124ms
124ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu_Cj_zF24K-DmW1OUXkJxtjmIPZ-7AR0vCB14yHqPiojeaXudbD9I1rn11808jw3hmLd8n1HKBcqWGvQMIQpO2ZGFd_-kkCVy1AWeIrpQdbWIIGG_YSm3QoQy5-izJc59xlotedkU3XM6CJ0jINYm-bIvaTwKumI3oI7O019EI2xzEdyHI&sai=AMfl-YSDHrIQtpIm948MiVzKwHG7QRiOPUyQKM3zWI3tMUn2JcxLATCpZDkoYlUeI_bi2NTcwkHfVLInJCdAbWTxH5Apz3_RPdg4A-oxYFo1n8TTJMesZTpR_Zs4ccFGakp0MyWY&sig=Cg0ArKJSzIhcd5fwzINZEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1206&vt=11&dtpt=728&dett=3&cstd=469&cisv=r20231011.72267&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 0BF3 1 KB
976 B 356ms
83ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=208&ttfrms=25&brid=3&brver=118.0.5993.70&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETar9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETar9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3EU42%3FFC%3Dl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETau&srcurlD=0&aUrlD=0&ssl=https:&uid=1697467696448602&jsCallback=dvCallback_1697467696448802&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=4811&tgjsver=4811&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Ffinclan.com%2F&fwc=0&fcl=2443&flt=0&fec=818&fcifrms=23&brh=2&dvp_epl=244&noc=4&nav_pltfrm=Win32&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://finclan.com/&c1=3007433&prr=1&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=103&auevent=ABAjH0jgNYxuqeKi8CF6c3SJkD9g&aucmp=18464393000&aucrtv=444942797&auorder=1009120791&ausite=610283236078&auxch=38&pltfrm=38&aufilter1=3007433&autt=1&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=1215716963942.9333&dvp_tukv=438510329.02468824&dvp_tuid=931586245715&jurtd=3957033143
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements4811.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: f9b41f9ac3f48b19bb4b95c2c2cb1d041b4c3b01614fb6ade4b15ec7c38f639f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:16 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 10/15/2023 14:48:16

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 9965 120 KB
41 KB 57ms
57ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:22:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73532
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:22:44 GMT

GET
H3 200 4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js Show response
pagead2.googlesyndication.com/bg/ Frame 7C23 37 KB
14 KB 56ms
56ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e102462cd94a7e7573dd74233c5f56d3770f732649a2b1d3eff05775d082b013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:18:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 333002
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14648
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:18:14 GMT

GET
H3 200 4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js Show response
pagead2.googlesyndication.com/bg/ Frame A9B5 37 KB
14 KB 56ms
56ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e102462cd94a7e7573dd74233c5f56d3770f732649a2b1d3eff05775d082b013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:18:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 333002
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14648
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:18:14 GMT

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 30A3 1 KB
973 B 275ms
87ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=121&ttfrms=8&brid=3&brver=118.0.5993.70&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETar9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETar9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3EU42%3FFC%3Dl9EEADTbpTauTau7%3A%3F4%3D2%3F%5D4%40%3ETau&srcurlD=0&aUrlD=0&ssl=https:&uid=1697467696523515&jsCallback=dvCallback_1697467696523948&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.70%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=4811&tgjsver=4811&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Ffinclan.com%2F&fwc=0&fcl=2443&flt=0&fec=818&fcifrms=23&brh=2&dvp_epl=244&noc=4&nav_pltfrm=Win32&ctx=11556288&cmp=28644182&sid=2742014&plc=347433751&crt=196764585&btreg=539180647&btadsrv=doubleclick&adsrv=1&advid=5673126&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=1215716963942.9333&dvp_tukv=3413429923.4059134&dvp_tuid=1198045027370&jurtd=3145161321
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements4811.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 99a54c63798256f6c3aea273c7ff4ad5deead957f9ae3d3511e1cec043a12909

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:16 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 10/15/2023 14:48:16

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C8D7 0
0 355ms
126ms Fetch
image/gif 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssP6sK5lj3rIKA1qxg8z07bV3cPZoXqNaY6Fplb1b-ePMEhZgOwlWP890Ltz8s4ZmJCbxz3ToVspWvtXer1tGZwarWUZ2O_XBy8nhtrNqAnBbbQBXPdwhEcoI1IVVQdsMELH9RGLR-6KZth7RM_gp0QkhFdZ33zpWccSNmrDw3VEN7HCr4BkJZvcz1bN1j0fatcGhO3O6fa8Fh33JMF9qVYG-DGh3plvAhMJwhgTV6zJDY9aO5VNrzMZe84hemLyAXXRBAIHZIKjcoY_fxViP_FW4PQWc6AKhPJ0jI6IzO2IIu3602cOXLt2au0EjrHZfWyxB3kcPzMWtb-c4LAvPjtbJbK0nD2NFZ-ww_1In4I_172gA4&sai=AMfl-YTYVu5KfK4-37uUm2__I79Tz3bqWWCMLm0a_gLpaY_JrNAY9NhXWKuKsteJFQfFvyuzJt2C_pmy9jIOBt_vUW9ZjbysqqUVXDBMA5eQExefmmOtCExjmeET39wUsQ&sig=Cg0ArKJSzGORTwKiMeenEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 14:48:16 GMT

GET
H3 200 Learn_With_Chegg_Vertical-_1.png_1661995732154_Learn_With_Chegg_Vertical-_1.png
s0.2mdn.net/dynamic/2/10998860/assets.chegg.com/image/upload/v1642528883/brand-assets/Logos/Chegg%20logo%202021/Learn%20with%20Chegg/ Frame F563 25 KB
25 KB 57ms
57ms Image
image/png 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10998860/assets.chegg.com/image/upload/v1642528883/brand-assets/Logos/Chegg%20logo%202021/Learn%20with%20Chegg/Learn_With_Chegg_Vertical-_1.png_1661995732154_Learn_With_Chegg_Vertical-_1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96f0df0872141f884e0135a0849ed55968377000782c76ceadfa48417b78f0fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12015261515640113651/index.html?e=69&leftOffset=0&topOffset=0&c=QSPczbnQcE&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:34:40 GMT
x-content-type-options: nosniff
age: 332016
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25666
x-xss-protection: 0
last-modified: Sat, 10 Sep 2022 06:13:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:34:40 GMT

GET
H3 200 60010569_20220818065906623_4yr_v1_728x90.png
s0.2mdn.net/ads/richmedia/studio/60010569/ Frame F563 29 KB
29 KB 66ms
66ms Image
image/png 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60010569/60010569_20220818065906623_4yr_v1_728x90.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd302cd177d4c4536184a1a9577dab0e196e9b794ed64ddb03d2df9fb80bbb6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12015261515640113651/index.html?e=69&leftOffset=0&topOffset=0&c=QSPczbnQcE&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:33:11 GMT
x-content-type-options: nosniff
age: 72905
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29618
x-xss-protection: 0
last-modified: Thu, 18 Aug 2022 13:59:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:33:11 GMT

GET
H3 200 container.html Show response
36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 48F9 6 KB
3 KB 58ms
57ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:09 GMT
expires: Tue, 15 Oct 2024 14:48:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C81C 6 KB
3 KB 61ms
60ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:09 GMT
expires: Tue, 15 Oct 2024 14:48:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 59ms
58ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJiNmM5OGE4YmIxNTc2NGYxYzRlZTMzMWRjYjcyNDE3OCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDAyLCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDI2LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDU5MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 83ms
81ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIzLTEwLTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjQyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 83ms
82ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImF1Y3Rpb25fZXBvY2giOjE2OTc0Njc2OTcsImFkX3Bvc2l0aW9uIjoxMDAxLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiYmlkX2Zsb29yX2luaXRpYWwiOjM1MCwiYmlkX2Zsb29yX3ByZXYiOjI2LCJiaWRfZmxvb3JfZmlsbGVkIjoyLCJhdWN0aW9uX2NvdW50Ijo1LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo3MTQsIm11bHRpX2FkX3VuaXQiOjIsIm11bHRpX2FkX2NvdW50IjozLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:17 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 81ms
80ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDM4LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQyNjUwMTc4OTY3NTAzOTEiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjEwMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQzOCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImI2Yzk4YThiYjE1NzY0ZjFjNGVlMzMxZGNiNzI0MTc4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0MjY1MDE3ODk2NzUwMzkxIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tYm94LTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDAyLCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDI2LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDM4LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDM4LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ0MzgifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQyNjUwMTc4OTY3NTAzOTEiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjEwMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQzOCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 81ms
81ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDM4LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMC0xNiJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiI0MjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 81ms
80ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhdWN0aW9uX2Vwb2NoIjoxNjk3NDY3Njk3LCJhZF9wb3NpdGlvbiI6MTAwMSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImJpZF9mbG9vcl9pbml0aWFsIjozNTAsImJpZF9mbG9vcl9wcmV2IjoyNiwiYmlkX2Zsb29yX2ZpbGxlZCI6MiwiYXVjdGlvbl9jb3VudCI6NSwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NzA0LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

GET
H3 200 TDGraphik-Semilight.woff
s0.2mdn.net/sadbundle/18330211981522502853/ Frame 9965 53 KB
53 KB 79ms
78ms Font
font/woff 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18330211981522502853/TDGraphik-Semilight.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bb2b288adf345540fd86820671236f035ab935c4937f2a255d424b7b211147d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:29:13 GMT
x-content-type-options: nosniff
age: 332343
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54220
x-xss-protection: 0
last-modified: Tue, 08 Aug 2023 17:04:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:29:13 GMT

GET
H3 200 TDGraphik-Bold.woff
s0.2mdn.net/sadbundle/18330211981522502853/ Frame 9965 56 KB
56 KB 71ms
70ms Font
font/woff 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18330211981522502853/TDGraphik-Bold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce70a83af3123d8f4d0614092cd54233ff4569d638e6c94d7cc3a3e767c30ea3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:20:41 GMT
x-content-type-options: nosniff
age: 332855
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57372
x-xss-protection: 0
last-modified: Tue, 08 Aug 2023 17:04:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:20:41 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 48F9 0
0 147ms
146ms Fetch
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CH445L00tZdmdO4TPzwXv1JfgDNesnIJuyur8vP0QwI23ARABIABgfYIBF2NhLXB1Yi02Mzk2ODQ0NzQyNDk3MjA4yAEJ4AIAqAMByAMCqgTmAU_QuXZc4uB0sc5AMmf5E_4tCVTraLxKSQ3Yrn5NyzEvO0wwq22GmURMJ4v0RlBL-KCXBFZc0xnL6LLZf2sgK4njtVOaIeSWSjvC47CwjBSB_RK3zyT3i3hWCOYSSfpPu1JOJu4_PkCfSvXwxrmYGTvvRI6foX8rs8GB8YgRwl3EFgpK0mKrpRqdZUVg0RDeuvY7k7cG51Mg2NH49H6pj_DGKAOCQBMw0PwazD4Uq9ZEcRDHnzyvwDPn_e4G0h-nDpCfC4pCdOtKm4JCF5mHRlyX8631-QclvXhfM5oFeQINt-ZPbGh54AQBgAa47Iy2nZ-54-0BoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEgiAYRABMgKKAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tOTMxMDE4MTU0NDk1ODA5MYAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi02Mzk2ODQ0NzQyNDk3MjA4GL7JBw&sigh=NTM6Qhz2mMI&uach_m=[UACH]&cid=CAQSOwDICaaNK1kxLjq6ORFd7PfKuJo0GYpfx4pPlkw9Ox8jPeRfuFGIJ6aemi252-iaCKw8EpMPd4KzqlgcGAE
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H/1.1 200
OK /
b1-chidc2.zemanta.com/bidder/win/googleadx_display/09f950b3-6c33-11ee-b734-a793947a5e8b/ZS1NLwAOztkKs-eEAAXqb9ZNQXjQpYJkkcNQhw/XBSUIVOMEFX6WCXSCJZIPBAEYEDAQBNVMDXZWSREAW46MKLLKUDB43S3B6KKC5S7EH2BIS... Frame 48F9 0
0 366ms
128ms Fetch 50.31.142.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://b1-chidc2.zemanta.com/bidder/win/googleadx_display/09f950b3-6c33-11ee-b734-a793947a5e8b/ZS1NLwAOztkKs-eEAAXqb9ZNQXjQpYJkkcNQhw/XBSUIVOMEFX6WCXSCJZIPBAEYEDAQBNVMDXZWSREAW46MKLLKUDB43S3B6KKC5S7EH2BIS5XYTCLWX4WDAAIT4L5LVJULS7JY3LXEDTPX57ZBVPXOPLZO4OMPLBVH6YZSZBIAV6EBJISTRITXXXDUFJJNOBFYV373EYV4QV4VISLV5F5K55MTQGTWW2CKSSEDA5UVYCB2WED4MZ6RATKVE625FMSKHFGS2ZOOIPDMYZYWVSV5OX2NYJLFBFN5EGBL75FY4YU4SIKY7JXH5DEF3LBWYFETLFFPIX2UP7P3SVDALN5QNST5PU4YBQG4HKRZVRVRJIFZX575QOY3XHRNCVZV4RJZSQ3XMSUPZZ7CTKG723LJJ3B77MY2L4RFNNVXV3EJNNA5FWBL5UPYWJ6NA37ROHL65HZ3TUTOKJHWCRDRAW3KW2JQBKJVPKXBF33QAGBACA4PF6WKCPO4STNJHBUI6OR67OAGIBDYTT2TWEUN2UHXB7COUPCOAQ36H4JFKIPHNTZQM2PI/?
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.127 Hickory Hills, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:16 GMT
Content-Length: 0

GET
H2 200 widget.js Show response
widgets.outbrain.com/n2d/widget/ Frame 48F9 46 KB
12 KB 82ms
82ms Script
application/x-javascript 23.207.57.76
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/n2d/widget/widget.js
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.57.76 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-57-76.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 18d8329b2e4b430a4f34b5247ba02ca5378fcdf574eb7ba5f1ef00ac0a705c5a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
content-length: 11833
last-modified: Tue, 22 Aug 2023 10:30:48 GMT
server: AkamaiNetStorage
etag: "6a7ff93f96fd30914785c7c30706bf6a:1692700788.526954"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Mon, 16 Oct 2023 18:48:16 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 48F9 3 KB
1 KB 62ms
61ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 48F9 20 KB
8 KB 63ms
62ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:26:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1316
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 14:26:20 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 48F9 0
0 127ms
126ms Image
text/html 2607:f8b0:4004:c06::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQUCwmEwSBMtvpLXAogi-E60Wwo-VHvDiQuHVNJaIlCb52JFRiKGlmxqXMYktiIKGAf1-bUr-XN3yrVU4uPGaMt7gGjqw
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::63 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 48F9 24 KB
6 KB 117ms
116ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sat, 14 Oct 2023 11:15:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 185578
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 13 Oct 2024 11:15:18 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 48F9 187 KB
59 KB 103ms
102ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:16 GMT

GET
H2 200 widget.js Show response
widgets.outbrain.com/n2d/widget/ Frame C81C 46 KB
12 KB 97ms
97ms Script
application/x-javascript 23.207.57.76
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/n2d/widget/widget.js
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.57.76 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-57-76.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 18d8329b2e4b430a4f34b5247ba02ca5378fcdf574eb7ba5f1ef00ac0a705c5a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
content-length: 11833
last-modified: Tue, 22 Aug 2023 10:30:48 GMT
server: AkamaiNetStorage
etag: "6a7ff93f96fd30914785c7c30706bf6a:1692700788.526954"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Mon, 16 Oct 2023 18:48:16 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame C81C 3 KB
1 KB 106ms
105ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame C81C 20 KB
8 KB 121ms
119ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:26:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1316
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 14:26:20 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C81C 0
0 122ms
120ms Image
text/html 2607:f8b0:4004:c06::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQQ4jfb7uIExXqN6-pt6FqN2jzaxEBZ_VLuEf4jDY6wliWj8XHi5LYPajT8PAt2Xl3JjCiOCDlk9MPnDK3PwyyIw6ccxQ
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::63 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame C81C 24 KB
6 KB 121ms
120ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sat, 14 Oct 2023 11:15:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 185578
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 13 Oct 2024 11:15:18 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C81C 187 KB
59 KB 106ms
106ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:16 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9965 8 KB
6 KB 112ms
111ms XHR
application/json 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

131d7830a52b7387daa237415bcf08b00edf76110fdbfe1d881f0360cb4698a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5830
x-xss-protection: 0

GET
H3 200 container.html Show response
36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DB8F 6 KB
3 KB 61ms
60ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:09 GMT
expires: Tue, 15 Oct 2024 14:48:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame DF3C 0
0 160ms
159ms Fetch
image/gif 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvMYZl46YicRNxxNm24xLj1huYFgIz0AC6bQ9_OB49ne9uxhDAWlY3GDFUEbDmRB63E70P8uX9bSifzJoyN9yw6uEfTDnOS07PiHVuS-U1mWslGL-RgPaXLU_uqNCQpjg5CLZ6TADPbE9kI4GyJegGSOMQLISK6hxECmzxk9pAkyegiRE5UuMuztEl8sEactNqeVw_cjVVpTebTNVu9rj_BIuEpIHHky597SSIopRG3apxRVlBkPZmSFY3tJHSqt0h5mS609nKqOh_lWYLVQdwUOwjKQS5YLze6FPHGqdv_JJxIwiWfE82jgcAu0OHD_L3_qcW2t5gG6kGdCl7UqXgU21VLqmDl_e5UG0sF&sai=AMfl-YTkm_WEj30T-pdFnee2mso3ZGrRSd08HBDzHmECz6h9EP10k2iadjZhInTwnUaSxnlryaGx6Sy4eVWPA64pzWzTTGcSyXUIkx4TXaCKR0L8VoOuhBuBArUyulLZbQ&sig=Cg0ArKJSzI4AckLU5NtbEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 120ms
118ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJiNmM5OGE4YmIxNTc2NGYxYzRlZTMzMWRjYjcyNDE3OCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDAyLCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDI2LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDM4LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzUxNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 120ms
117ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIzLTEwLTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjQyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:17 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 58ms
56ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImF1Y3Rpb25fZXBvY2giOjE2OTc0Njc2OTcsImFkX3Bvc2l0aW9uIjoxMDAxLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiYmlkX2Zsb29yX2luaXRpYWwiOjM1MCwiYmlkX2Zsb29yX3ByZXYiOjI2LCJiaWRfZmxvb3JfZmlsbGVkIjoyLCJhdWN0aW9uX2NvdW50Ijo1LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo5NDUsIm11bHRpX2FkX3VuaXQiOjEsIm11bHRpX2FkX2NvdW50IjozLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:16 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:16 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 494A 0
0 199ms
199ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstttqFgKd9w3FT88yZI0rjDTgCuyBkqGAjiEjxqyLsh0xFLTKPSDsCSjDrsDV1qHuQCAsmMTxwlW2juJQ1G60_d-MOlUN3AkUuDAoRsOGTpg5fB2l_I6sFoFtJIE6VmBK8BzhZ99OtZ-xikL_bpydA7UYcX-kWPxIqxXnkpizTra3HmfiF-dN41FMRNSKnR9WW_rdrOo63uUjGDnNGCgMlZDAKzPfVj&sai=AMfl-YSMJ13VlMQAh1SMmBfkFotl-0sScyroGRf8UA1EnltAdzMvofDRSuSuc9u_F_51i58MFwC182PxaSMS8iMqcVmm4ob4tO26bFwLvAN_WpeHpkhq7GR66Leqc4Uuq3UmMIa1fkc7JbsV131FBzxTu609_r79Hrw&sig=Cg0ArKJSzJwpD6j7rBwCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=652&vt=11&dtpt=476&dett=3&cstd=165&cisv=r20231004.97087&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9965 17 KB
6 KB 146ms
145ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 16 Oct 2023 14:48:16 GMT

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ Frame 48F9 990 B
1 KB 156ms
156ms Image
image/svg+xml 23.207.57.76
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/n2d/widget/widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.57.76 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-57-76.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Wed, 15 Nov 2023 14:48:16 GMT
date: Mon, 16 Oct 2023 14:48:16 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "5ab8e16b5f46213840bcd403e349419c:1673369393.880194"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 990
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H/1.1 200
OK /
b1t-chidc2.zemanta.com/t/imp/impression/WCATURALKL33IBVG5JQG2O2VZG5KLONGJN65GERVCDD72EUZNTAV6H24STFJ4PSRUUI2LF5M5CSS42BZWKULJUGKT27TDUJXABZB4PWHVGZP3VQN6UENNCLMJRYYHOQTZQ5MW4S6X7SNIBAIX56NNXVTSZ6HO... Frame 48F9 26 B
127 B 591ms
148ms Image
image/gif 50.31.142.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1t-chidc2.zemanta.com/t/imp/impression/WCATURALKL33IBVG5JQG2O2VZG5KLONGJN65GERVCDD72EUZNTAV6H24STFJ4PSRUUI2LF5M5CSS42BZWKULJUGKT27TDUJXABZB4PWHVGZP3VQN6UENNCLMJRYYHOQTZQ5MW4S6X7SNIBAIX56NNXVTSZ6HOVWAHYFITV2WSIQBP7YSAZWRIPQ36X5CCE4XH6KQLJWQAW32HZ46RTCJOKZ7XQFVVIJAWRMILQDPXU4SRFN2HWB37Q73TAR3JWV4YNXUTZDTLT5LQURGMS64KQGMYCQMACWNNKDNNFMFP4GNKCAY4E2MYGYLNB6EZYEZR4EGDSYYUGPP7YP763CO2C36O6C2WNBWDSAXVMABDOC4SGDQTLVQ/?
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.127 Hickory Hills, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:17 GMT
Content-Length: 26
Content-Type: image/gif

GET
H3 200 Learn_With_Chegg_Vertical_Orange.png_1661995732154_Learn_With_Chegg_Vertical_Orange.png
s0.2mdn.net/dynamic/2/10998860/assets.chegg.com/image/upload/v1644875809/brand-assets/Logos/Chegg%20logo%202021/Learn%20with%20Chegg/ Frame 8E03 2 KB
2 KB 248ms
248ms Image
image/png 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10998860/assets.chegg.com/image/upload/v1644875809/brand-assets/Logos/Chegg%20logo%202021/Learn%20with%20Chegg/Learn_With_Chegg_Vertical_Orange.png_1661995732154_Learn_With_Chegg_Vertical_Orange.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67abd2f4d08c4a99a143a0cfed58af9dcc49d4ae7cae58083274d8bf50185962

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:46:20 GMT
x-content-type-options: nosniff
age: 331316
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2437
x-xss-protection: 0
last-modified: Sat, 10 Sep 2022 17:43:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:46:20 GMT

GET
H3 200 60010569_20220818065855341_4yr_v1_160x600.png
s0.2mdn.net/ads/richmedia/studio/60010569/ Frame 8E03 71 KB
71 KB 248ms
248ms Image
image/png 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60010569/60010569_20220818065855341_4yr_v1_160x600.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18760615e244aa3f713e2e34c5061c6a9bcc76fc086ccc526777048c19eae6e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10238320202236180630/index.html?e=69&leftOffset=0&topOffset=0&c=rfzvj5qWrj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:41:13 GMT
x-content-type-options: nosniff
age: 72423
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72803
x-xss-protection: 0
last-modified: Thu, 18 Aug 2022 13:58:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:41:13 GMT

GET
H2 200 3bd981d291bd960206547ef6288083dcec.jpg
zem.outbrainimg.com/p/srv/sha/41/e7/5f/ Frame 48F9 15 KB
16 KB 488ms
153ms Image
image/jpeg 146.75.30.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zem.outbrainimg.com/p/srv/sha/41/e7/5f/3bd981d291bd960206547ef6288083dcec.jpg?fit=crop&crop=edges&thomcrop&w=298&h=138&fm=jpg

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

146.75.30.132 Ashburn, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

651cd6423fca6855d27dc3889d4546ff161c68e512ed7b684e0c4ad1633affc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
via: 1.1 varnish
x-content-type-options: nosniff
age: 2415025
x-cache: HIT, HIT, HIT
x-imgix-id: 60b9cd6fb52eeef2b0d3ffa2424af741c72c14bc
cross-origin-resource-policy: cross-origin
content-length: 15838
x-served-by: cache-sjc1000136-SJC, cache-iad-kjyo7100177-IAD, cache-iad-kiad7000021-IAD
x-imgix-render-farm: 01.140360
last-modified: Mon, 18 Sep 2023 15:57:52 GMT
server: imgix
x-timer: S1697467697.332806,VS0,VE1
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1

GET
H/1.1

204
No Content

event.png
tpsc-ue1.doubleverify.com/ Frame 30A3
Redirect Chain

https://cdn.doubleverify.com/redirect/?host=tpsc-ue1&param=akipv6&impid=eda0e578d6ba446ab0ca1ce34383d28c&dup=&eoid=1000&cbust=1697467696955393
https://tpsc-ue1.doubleverify.com/event.png?impid=eda0e578d6ba446ab0ca1ce34383d28c&akipv6=2001:4958:1420:15c::142&dup=&eoid=1000

0
162 B

513ms
167ms

Image
text/plain

34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpsc-ue1.doubleverify.com/event.png?impid=eda0e578d6ba446ab0ca1ce34383d28c&akipv6=2001:4958:1420:15c::142&dup=&eoid=1000
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:17 GMT
Cache-Control: max-age=0
Connection: keep-alive
Expires: 2023-10-15T14:48:17

Redirect headers

Location: https://tpsc-ue1.doubleverify.com/event.png?impid=eda0e578d6ba446ab0ca1ce34383d28c&akipv6=2001:4958:1420:15c::142&dup=&eoid=1000
Date: Mon, 16 Oct 2023 14:48:17 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ Frame C81C 990 B
1 KB 216ms
216ms Image
image/svg+xml 23.207.57.76
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/n2d/widget/widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.207.57.76 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-207-57-76.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Wed, 15 Nov 2023 14:48:17 GMT
date: Mon, 16 Oct 2023 14:48:17 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "5ab8e16b5f46213840bcd403e349419c:1673369393.880194"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 990
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H/1.1 200
OK /
b1t-nydc1.zemanta.com/t/imp/impression/WCATURALKL33IX6FV3YUVXFCCS5KLONGJN65GEWTB6O4BGCZRDOQ7GH3VRQ4K2B6UGPHXDUF223K7VXATFQQJQKAEJUFGUOTRIOICUFRGE5ZL62HEI57NAYSOXBUU356RCBHAINB3R6TKBAIX56NNXVTSZ6HOV... Frame C81C 26 B
127 B 661ms
176ms Image
image/gif 70.42.32.95
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1t-nydc1.zemanta.com/t/imp/impression/WCATURALKL33IX6FV3YUVXFCCS5KLONGJN65GEWTB6O4BGCZRDOQ7GH3VRQ4K2B6UGPHXDUF223K7VXATFQQJQKAEJUFGUOTRIOICUFRGE5ZL62HEI57NAYSOXBUU356RCBHAINB3R6TKBAIX56NNXVTSZ6HOVWAHYFITV2WSIQBP7YSAZWRIPQ36X5CCE4XH6KQLJWQAW32HZ46RTCJOKZ7XQFVVIJAWRMILQDPXU4SRFN2HWB37Q73TAR3JWV4YNXUTZDTLT5LQURGMS64KQGMYCQMACWNNKDNNFMFP4GNKCAY4E2NR4SLY7JTZE6WR4EGDSYYUGPP7YP763CO2C36O6C2WNBWDSAXVMABDOC4SGDQTLVQ/?
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.95 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:17 GMT
Content-Length: 26
Content-Type: image/gif

GET
H/1.1

204
No Content

event.png
tpsc-ue1.doubleverify.com/ Frame 0BF3
Redirect Chain

https://cdn.doubleverify.com/redirect/?host=tpsc-ue1&param=akipv6&impid=9f779cb5ce84453f970168cb20cb2700&dup=&eoid=1000&cbust=1697467696963235
https://tpsc-ue1.doubleverify.com/event.png?impid=9f779cb5ce84453f970168cb20cb2700&akipv6=2001:4958:1420:15c::142&dup=&eoid=1000

0
162 B

497ms
166ms

Image
text/plain

34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpsc-ue1.doubleverify.com/event.png?impid=9f779cb5ce84453f970168cb20cb2700&akipv6=2001:4958:1420:15c::142&dup=&eoid=1000
Requested by: Host: finclan.com
URL: https://finclan.com/
Protocol: HTTP/1.1
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:17 GMT
Cache-Control: max-age=0
Connection: keep-alive
Expires: 2023-10-15T14:48:17

Redirect headers

Location: https://tpsc-ue1.doubleverify.com/event.png?impid=9f779cb5ce84453f970168cb20cb2700&akipv6=2001:4958:1420:15c::142&dup=&eoid=1000
Date: Mon, 16 Oct 2023 14:48:17 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 57A3 1 KB
643 B 260ms
260ms Document
text/html 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 73190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 18:28:26 GMT
etag: 48472445140208031
expires: Mon, 16 Oct 2023 18:28:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame DB8F 24 KB
10 KB 250ms
250ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c548a30c41171b00c7d332fc539aa7fa0dceb71fc7d91d4bc7b65ed3bfed8382

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:40:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 456
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9959
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 13:24:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 16 Oct 2023 15:40:41 GMT

GET
H3 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame DB8F 35 KB
14 KB 250ms
250ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/m_js_controller_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65ba2edc4517131a88b842e0c3adcd034ab50ebfdcd9c31554a25b075942b1bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12623
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14041
x-xss-protection: 0
server: cafe
etag: 12153372478858386210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:17:54 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame DB8F 3 KB
1 KB 388ms
387ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9659
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame DB8F 20 KB
8 KB 382ms
381ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:26:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1317
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 14:26:20 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DB8F 0
0 436ms
435ms Image
text/html 2607:f8b0:4004:c06::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTngHXRLYyG8sNiii9KXVqNNMseQJuBn6ErtS3842jM4n19cBvXuL_X94VO5_T66B2TVKl9W0C8x3aCIgRraf3gAvQGcQ
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::63 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DB8F 187 KB
59 KB 249ms
248ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:17 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame DB8F 23 KB
9 KB 388ms
387ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:09:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13099
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9145
x-xss-protection: 0
server: cafe
etag: 13066256994748809036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:09:58 GMT

GET
DATA 200
OK truncated
/ Frame 48F9 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e06d5af864240b1766e2c5f1d7d7a0e61b72fb87c3bf40dbed3bed5b2cc4e13c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 3bd981d291bd960206547ef6288083dcec.jpg
zem.outbrainimg.com/p/srv/sha/41/e7/5f/ Frame C81C 16 KB
16 KB 433ms
153ms Image
image/jpeg 146.75.30.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zem.outbrainimg.com/p/srv/sha/41/e7/5f/3bd981d291bd960206547ef6288083dcec.jpg?fit=crop&crop=entropy&thomcrop&w=298&h=138&fm=jpg

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

146.75.30.132 Ashburn, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

be4894359950ccfb7ad6f8d233a1ee80a548bd21e5d472d885917e6422bbe5f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
via: 1.1 varnish
x-content-type-options: nosniff
age: 2463642
x-cache: HIT, MISS, HIT
x-imgix-id: 7cee5c668ae881dd63f73a0dc7137cf090f316f3
cross-origin-resource-policy: cross-origin
content-length: 15918
x-served-by: cache-sjc10055-SJC, cache-iad-kjyo7100064-IAD, cache-iad-kiad7000021-IAD
x-imgix-render-farm: 01.139848
last-modified: Mon, 18 Sep 2023 02:27:35 GMT
server: imgix
x-timer: S1697467697.332785,VS0,VE1
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FFD7 1 KB
643 B 356ms
356ms Document
text/html 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 73191
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 18:28:26 GMT
etag: 48472445140208031
expires: Mon, 16 Oct 2023 18:28:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C81C 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f54643bc12b1c4242850c200d2250eef64e5b232c3d87f005bfd9b90a114a76

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3942 42 B
64 B 219ms
218ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsur93hTj4joLINMO3KZvME08oyeEK0IvOxVb1ikonaGSqP12SmYkJwfQVAn5iQ_H0oqUJsUhR_edkIFLd4_3HAAFt8Db0xRP2_W9BOcMYVLvt4&sig=Cg0ArKJSzDGACDO7yI3gEAE&id=lidar2&mcvt=1013&p=0,0,600,160&mtos=1013,1013,1013,1013,1013&tos=1013,0,0,0,0&v=20231011&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=34&adk=0&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467694740&rpt=1259&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame ABB2 42 B
64 B 216ms
216ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvlCgxqCuwZtVjp0sSSFgDdAjDTZdNogSb2T1GgzhU1uyus5YhexoKWLCK9dDyhyZh9H4CRYlbsNjZZkqRe81yqN3XrSywAnUIuHe6HOLNnJh8&sig=Cg0ArKJSzK-ceq99bYHEEAE&id=lidar2&mcvt=1015&p=0,0,90,728&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&v=20231011&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=34&adk=0&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467694783&rpt=1240&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js Show response
pagead2.googlesyndication.com/bg/ Frame 7CC0 37 KB
14 KB 302ms
301ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e102462cd94a7e7573dd74233c5f56d3770f732649a2b1d3eff05775d082b013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:18:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 333003
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14648
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:18:14 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame 57A3 43 B
484 B 356ms
356ms Image
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEF_xC98Eq8ef2ZIUPTMCFko&google_cver=1&google_push=AXcoOmTRWJiwkC1O856MGBSgQwvH6O4MItKaI9Sw1aRha8EbSekECDebz3Orw7UYlswKt0_LgsDhj4gWZxG6x4IlzRyZLWSqnJIA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTRWJiwkC1O856MGBSgQwvH6O4MItKaI9Sw1aRha8EbSekECDebz3Orw7UYlswKt0_LgsDhj4gWZxG6x4IlzRyZLWSqnJIA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 81711a141871a217-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57A3
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEGIuVOmMGdt4KYEE1ssbxwU&google_cver=1&google_push=AXcoOmRQYBHZ8zFTRb6YwW1udHgisU3UZT9YY3eau8na-RvMNiA0kZj4jO7YJk5LPC7xulkUMyQwiHHGYn8WbYzYxC...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjEwZmNhOWItZmIzZi00MDRjLWI2NmMtMzVjZTk3ZDVlZWEx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1

170 B
188 B

186ms
185ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjEwZmNhOWItZmIzZi00MDRjLWI2NmMtMzVjZTk3ZDVlZWEx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjEwZmNhOWItZmIzZi00MDRjLWI2NmMtMzVjZTk3ZDVlZWEx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1
date: Mon, 16 Oct 2023 14:48:17 GMT
server: Kestrel
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57A3
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPhtjjlbtweeiAlXMvzfwRY&google_cver=1&google_push=AXcoOmSW731TUILR_bZoichOBHyF8IEBshQEdegBzLFslOT8LxkxevJ4wwnxumjg7A128S_5OwTlYU4VgRpsO_30I...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmSW731TUILR_bZoichOBHyF8IEBshQEdegBzLFslOT8LxkxevJ4wwnxumjg7A128S_5OwTlYU4VgRpsO_30IDBOEFT34l_y&google_hm=Hfv4fLZHqH1XBF01QoauFBC6

170 B
188 B

119ms
119ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmSW731TUILR_bZoichOBHyF8IEBshQEdegBzLFslOT8LxkxevJ4wwnxumjg7A128S_5OwTlYU4VgRpsO_30IDBOEFT34l_y&google_hm=Hfv4fLZHqH1XBF01QoauFBC6

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 16 Oct 2023 14:48:17 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmSW731TUILR_bZoichOBHyF8IEBshQEdegBzLFslOT8LxkxevJ4wwnxumjg7A128S_5OwTlYU4VgRpsO_30IDBOEFT34l_y&google_hm=Hfv4fLZHqH1XBF01QoauFBC6
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET pub
cs.chocolateplatform.com/ Frame 57A3 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57A3
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmQtGSDdj6TwEswV2mHvcbFk0aQo4uWSoql54Yqp_-IFuepU-7rHeR8a_N17jEFABFdO_WetD-xVn55x6D5n3evAhBLvfYVfeA&google_gid=CAESEHykAvi18dh...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHykAvi18dhKaReArjvv4_g&google_hm=T1BVNWQ2NDg0YThmNmE5NDFjMzhhOGY1NWVhNDY3YjgyNGE&google_nid=opera_norway_as&google_push=AXcoOmQtGSDd...

170 B
188 B

159ms
158ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHykAvi18dhKaReArjvv4_g&google_hm=T1BVNWQ2NDg0YThmNmE5NDFjMzhhOGY1NWVhNDY3YjgyNGE&google_nid=opera_norway_as&google_push=AXcoOmQtGSDdj6TwEswV2mHvcbFk0aQo4uWSoql54Yqp_-IFuepU-7rHeR8a_N17jEFABFdO_WetD-xVn55x6D5n3evAhBLvfYVfeA

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: nginx
access-control-allow-methods: POST, GET
content-type: text/html; charset=utf-8
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHykAvi18dhKaReArjvv4_g&google_hm=T1BVNWQ2NDg0YThmNmE5NDFjMzhhOGY1NWVhNDY3YjgyNGE&google_nid=opera_norway_as&google_push=AXcoOmQtGSDdj6TwEswV2mHvcbFk0aQo4uWSoql54Yqp_-IFuepU-7rHeR8a_N17jEFABFdO_WetD-xVn55x6D5n3evAhBLvfYVfeA
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 326
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57A3
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESELgLQzcaj...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=a77dcf3e-0a02-43b0-ba25-509c697b290e&%%GOOGLE_PUSH_PAIR%%

170 B
188 B

164ms
164ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=a77dcf3e-0a02-43b0-ba25-509c697b290e&%%GOOGLE_PUSH_PAIR%%

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=a77dcf3e-0a02-43b0-ba25-509c697b290e&%%GOOGLE_PUSH_PAIR%%
Date: Mon, 16 Oct 2023 14:48:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57A3
Redirect Chain

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_...
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3&google_cver=1&google_gid=CAESEMEVuQl5CxlBQaK_cdv-n5E&gdpr_consent=${GDPR_CONSENT_109}&google_...

170 B
188 B

85ms
85ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3&google_cver=1&google_gid=CAESEMEVuQl5CxlBQaK_cdv-n5E&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmQRpKyUnsBY9GZrTH0joKmz7E2H2ewWfDAmt4HVF72xKPzyrUsR7lYCGLMb3u55gmdL9Chc6Ou8Jr9OqJf3mr-K2cB4_ar_Ig&gdpr=${GDPR}

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3&google_cver=1&google_gid=CAESEMEVuQl5CxlBQaK_cdv-n5E&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmQRpKyUnsBY9GZrTH0joKmz7E2H2ewWfDAmt4HVF72xKPzyrUsR7lYCGLMb3u55gmdL9Chc6Ou8Jr9OqJf3mr-K2cB4_ar_Ig&gdpr=${GDPR}
date: Mon, 16 Oct 2023 14:48:18 GMT
server: _
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 57A3 0
12 B 136ms
135ms Image
text/html 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LLGhEORMYcEjiCRAfxd41lEbgeKQ0fmImmcYIx4_f_kBEoDWHIzeCIqM0fY-6rXqE0O-Qi6GXg

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 impl_v97.js Show response
www.googletagservices.com/dcm/ Frame DB8F 57 KB
23 KB 118ms
118ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v97.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b23a2a55e15ddffdc187b1107030f6ed53d4abe5d4c0900022451d20c3dfb54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:52:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262523
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23166
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 13:28:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 13:52:54 GMT

GET
H3 200 container.html Show response
36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7317 6 KB
3 KB 122ms
122ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310110101/pubads_impl.js?cb=31078769

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://finclan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:09 GMT
expires: Tue, 15 Oct 2024 14:48:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 119ms
117ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM2OTE3MzE5NDc2MjIxOSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTExNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ4MTc3MzU0MjAsImNyZWF0aXZlX2lkIjoxMzgyNDYxMDU4NDIsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM2OTE3MzE5NDc2MjIxOSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTExNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ4MTc3MzU0MjAsImNyZWF0aXZlX2lkIjoxMzgyNDYxMDU4NDIsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJ6ZXJvIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzY5MTczMTk0NzYyMjE5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDAwMiwiYWRfcG9zaXRpb24iOjExMTQsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDAwMiwiYmlkX2Zsb29yX3ByZXYiOjAuMDAwMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDgxNzczNTQyMCwiY3JlYXRpdmVfaWQiOjEzODI0NjEwNTg0MiwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczNjkxNzMxOTQ3NjIyMTkiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjExMTQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0ODE3NzM1NDIwLCJjcmVhdGl2ZV9pZCI6MTM4MjQ2MTA1ODQyLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyNDYxMDU4NDIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczNjkxNzMxOTQ3NjIyMTkiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjExMTQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0ODE3NzM1NDIwLCJjcmVhdGl2ZV9pZCI6MTM4MjQ2MTA1ODQyLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0ODE3NzM1NDIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:17 GMT

GET
H3 200 4817735420 Show response
go.ezodn.com/dac/ 0
574 B 123ms
122ms XHR
text/plain 2606:4700:e2::ac40:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/4817735420
Requested by: Host: finclan.com
URL: https://finclan.com/porpoiseant/banger.js?cb=195-2&bv=276&v=99&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5
alt-svc: h3=":443"; ma=86400
content-length: 0
last-modified: Mon, 16 Oct 2023 13:49:27 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://finclan.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YsNBxlY9scKYm15t4Ha8ZecRyOxfo%2FtXK17REmLVQdWG77qU4K5yzizZgUJ4naEGr3FKGX5Y6c6npqDz%2BmfOh3Pub%2F%2FyBpGft1IOWQmIupiq9rrpVG52dyK4oyWRdAUz7Wz5X2dcgZ8Km08%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 81711a145a8c29a0-ORD
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 161ms
160ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM2OTE3MzE5NDc2MjIxOSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTExNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ4MTc3MzU0MjAsImNyZWF0aXZlX2lkIjoxMzgyNDYxMDU4NDIsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIzLTEwLTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjQyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:17 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 159ms
158ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzM2OTE3MzE5NDc2MjIxOSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhdWN0aW9uX2Vwb2NoIjoxNjk3NDY3Njk3LCJhZF9wb3NpdGlvbiI6MTExNCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImJpZF9mbG9vcl9pbml0aWFsIjo1NTAsImJpZF9mbG9vcl9wcmV2Ijo0LCJiaWRfZmxvb3JfZmlsbGVkIjowLCJhdWN0aW9uX2NvdW50Ijo2LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo5MjMsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NDgxNzczNTQyMH1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:17 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame FFD7
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1&google_push=AXcoOmQeKhN6WXnwnv9AMMjCOzSc_Re-Kp2T4h-8JZ-JrmwtqBWINA5jJnWe7xOEaXRxazDGazzqv1FDvSgXoWnh_qOmrnqbdlA
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQwODg3ODg5MjM5OTQwNDE0NQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1

43 B
398 B

202ms
173ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD7
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEFMcGvtKnXVLUtJEFQezIFw&google_cver=1&google_push=AXcoOmRcKsNZ-7xqR_i94tj4RuCz0XljX4UuW7a5z3EWsu6kmrBz5fZhF0jQ6lJvevV9xqZlllOcnhX7EBi5CISa...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=i4lNg7YmTjUPcojKj1I47A&google_push=AXcoOmRcKsNZ-7xqR_i94tj4RuCz0XljX4UuW7a5z3EWsu6kmrBz5fZhF0jQ6lJvevV9xqZlllOcnhX7EBi5CISaA_4X6gVbGdY

170 B
188 B

83ms
82ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=i4lNg7YmTjUPcojKj1I47A&google_push=AXcoOmRcKsNZ-7xqR_i94tj4RuCz0XljX4UuW7a5z3EWsu6kmrBz5fZhF0jQ6lJvevV9xqZlllOcnhX7EBi5CISaA_4X6gVbGdY

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 16 Oct 2023 14:48:17 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=i4lNg7YmTjUPcojKj1I47A&google_push=AXcoOmRcKsNZ-7xqR_i94tj4RuCz0XljX4UuW7a5z3EWsu6kmrBz5fZhF0jQ6lJvevV9xqZlllOcnhX7EBi5CISaA_4X6gVbGdY
x-host: tde-deliveryengine-production-69fbf984b9-kbmvc
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD7
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDTJV__7UBjqC9cr9irHNYY&google_cver=1&google_push=AXcoOmRFMrpXZ9unSDagmvasthgSQEAAGYgCw2OYXx6OerwzOB5ntsuL2970c0beawZrnjej97SfWP0T...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQ5OTA2MzQwMTgzMjkyMzIwNA&google_push=AXcoOmRFMrpXZ9unSDagmvasthgSQEAAGYgCw2OYXx6OerwzOB5ntsuL2970c0beawZrnjej97SfWP...

170 B
188 B

154ms
154ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQ5OTA2MzQwMTgzMjkyMzIwNA&google_push=AXcoOmRFMrpXZ9unSDagmvasthgSQEAAGYgCw2OYXx6OerwzOB5ntsuL2970c0beawZrnjej97SfWP0TOnjkSqodzbj262mG12E

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQ5OTA2MzQwMTgzMjkyMzIwNA&google_push=AXcoOmRFMrpXZ9unSDagmvasthgSQEAAGYgCw2OYXx6OerwzOB5ntsuL2970c0beawZrnjej97SfWP0TOnjkSqodzbj262mG12E
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD7
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEAtvfWvqr1eTdPpD4eQ7UZU&google_cver=1&google_push=AXcoOmT7NtbJ8c-8ujYCIfuq7Qx8HFVr2Iv362WKYqhELwQ59NJr0AWkit2btvBxv13eZ96p1BCSjfGAhYMgjYGMgVtDGPVSNmlx
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmT7NtbJ8c-8ujYCIfuq7Qx8HFVr2Iv362WKYqhELwQ59NJr0AWkit2btvBxv13eZ96p1BCSjfGAhYMgjYGMgVtDGPVSNmlx&google_hm=R6iz6uHswjEfs-t-cP5j6w==

170 B
188 B

156ms
156ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmT7NtbJ8c-8ujYCIfuq7Qx8HFVr2Iv362WKYqhELwQ59NJr0AWkit2btvBxv13eZ96p1BCSjfGAhYMgjYGMgVtDGPVSNmlx&google_hm=R6iz6uHswjEfs-t-cP5j6w==

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmT7NtbJ8c-8ujYCIfuq7Qx8HFVr2Iv362WKYqhELwQ59NJr0AWkit2btvBxv13eZ96p1BCSjfGAhYMgjYGMgVtDGPVSNmlx&google_hm=R6iz6uHswjEfs-t-cP5j6w==
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 229

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD7
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEKbvo-QcbkH83XI-g5AXZyQ&google_cver=1&google_push=AXcoOmQKo_VrtHbKyFLPBeFsxWQ29kl9Gz6uOQviyJp3uM2NzaKSio_zDongVyCVvw-Esq6zKjShD0UXgI36...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1iSTk97rChchEigStTn4c64t0_EBfMQ&google_push=AXcoOmQKo_VrtHbKyFLPBeFsxWQ29kl9Gz6uOQviyJp3uM2NzaKSio_zDongVyCVvw-Esq6zKjShD0UXgI...

170 B
188 B

161ms
161ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1iSTk97rChchEigStTn4c64t0_EBfMQ&google_push=AXcoOmQKo_VrtHbKyFLPBeFsxWQ29kl9Gz6uOQviyJp3uM2NzaKSio_zDongVyCVvw-Esq6zKjShD0UXgI368u8L2YOnbafcwU-C

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABizj1iSTk97rChchEigStTn4c64t0_EBfMQ&google_push=AXcoOmQKo_VrtHbKyFLPBeFsxWQ29kl9Gz6uOQviyJp3uM2NzaKSio_zDongVyCVvw-Esq6zKjShD0UXgI368u8L2YOnbafcwU-C
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD7
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESECKjo2DU6pf2BEGC2hAWedk&google_cver=1&google_push=AXcoOmRCwVW--oJZJaTB7-6fdsQ0QDwIHlSZgiBz113eo4mqOnfqw1w_c_sVIdIzV2MsCrnweluIs3t9gm2aJmsHV-IRDI8nqzMy
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmRCwVW--oJZJaTB7-6fdsQ0QDwIHlSZgiBz113eo4mqOnfqw1w_c_sVIdIzV2MsCrnweluIs3t9gm2aJmsHV-IRDI8nqzMy&google_hm=90bfa6811c8ce48d629...

170 B
188 B

153ms
153ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmRCwVW--oJZJaTB7-6fdsQ0QDwIHlSZgiBz113eo4mqOnfqw1w_c_sVIdIzV2MsCrnweluIs3t9gm2aJmsHV-IRDI8nqzMy&google_hm=90bfa6811c8ce48d629dd59940ce0735

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmRCwVW--oJZJaTB7-6fdsQ0QDwIHlSZgiBz113eo4mqOnfqw1w_c_sVIdIzV2MsCrnweluIs3t9gm2aJmsHV-IRDI8nqzMy&google_hm=90bfa6811c8ce48d629dd59940ce0735
date: Mon, 16 Oct 2023 14:48:17 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFD7
Redirect Chain

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_...
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3&google_cver=1&google_gid=CAESEMEVuQl5CxlBQaK_cdv-n5E&gdpr_consent=${GDPR_CONSENT_109}&google_...

170 B
188 B

80ms
80ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3&google_cver=1&google_gid=CAESEMEVuQl5CxlBQaK_cdv-n5E&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmQMRa8CRgvatXD9hAYx4VVxG7ePdXADn9GO_wsk0M5sGag9Sqnr8jEDXA0leAxdvWfW1C3OVpx5XSLe0ucW_r-6s1R1YQEhwQ&gdpr=${GDPR}

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=1a4fd98d-51fa-4cd9-b21a-8dfd5a47d5d3&google_cver=1&google_gid=CAESEMEVuQl5CxlBQaK_cdv-n5E&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmQMRa8CRgvatXD9hAYx4VVxG7ePdXADn9GO_wsk0M5sGag9Sqnr8jEDXA0leAxdvWfW1C3OVpx5XSLe0ucW_r-6s1R1YQEhwQ&gdpr=${GDPR}
date: Mon, 16 Oct 2023 14:48:18 GMT
server: _
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame FFD7 0
12 B 164ms
162ms Image
text/html 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LORYCgZGAhMU3n1NgxxlMlGMTxYsdqvkTxLGSZs851sFYPlf6E2hESP0SSO97xxQNL-O-WaQ

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
291 B 562ms
562ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.12/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://finclan.com
Date: Mon, 16 Oct 2023 14:48:17 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81

GET
H2 200 B30583481.375632492;dc_ver=97.287;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=3656561813;ord=6kcteq;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DCplWFME0tZQmRpKD8D9fnubgOod2f3X... Show response
ad.doubleclick.net/ddm/adj/N636.1508339ADWORDS.COM/ Frame DB8F 76 KB
32 KB 188ms
186ms Script
text/javascript 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N636.1508339ADWORDS.COM/B30583481.375632492;dc_ver=97.287;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=3656561813;ord=6kcteq;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DCplWFME0tZQmRpKD8D9fnubgOod2f3XC4t4GfyhFkEAEg9PnGJWB9oAHqpZWiAsgBCeACAKgDAcgDAqoEhwJP0Gh8Q7tsLhftYSesU8VT9oWf4nYr0UKI4jC-dP1Evqdgl216cDwfcEYeIJxFsXULbw9uRLKb3ZnvRzs38N8ySmsUo3_hn1Xl8Z1PWA9EqUt1zr1NVZL2j_7g9SYjsTVyI5D6DPnuBD7NvRt-Q4AHvFGOF7dXhRo77Ilyz8GQYkTUhqTJBpIp57Sp-3omKxcQZrJ6Hx_UxzCTJCDFuanWBeH-EmDpwBaJgZlmS8LUPZ4d-QNfOploGaucMSldajb1tUPdbbm8m9xAE0EW3otri5ugTS-QNSrd2aRlDwgH_mPALWkPQW_gKPVrr995bDgs7bo6C3CFFbhdCkemnLJ0JnARY-pLA8AEypHs9vwD4AQBiAXJ0JHDQKAGEYAHmN7_3wGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcA0ggUCIBhEAEYHTICigI6AoBASL39wTryCBthZHgtc3Vic3luLTkzMTAxODE1NDQ5NTgwOTGACgOYCwHICwGADAHaDBEKCxCwo4nc6cH3_p0BEgIBA6oNAkNByA0B4g0TCMSrovjn-oEDFRESiAkd13MO59gTDNAVAfgWAYAXAQ%26ase%3D2%26gclid%3DEAIaIQobChMIidim-Of6gQMVERKICR3Xcw7nEAEYASAAEgKWiPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaN51DCh2ugkUDR7DccqMoeGe7lV0P-M1z2nE9eiWqrQwZc3HOe51AZnC4PlcpN_b0WNBQgsUMlGAE%26sig%3DAOD64_2mid-3_VpGTQf6lxlwMGdC53pmrw%26client%3Dca-pub-6396844742497208%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Ffinclan.com%2F$0;xdt=1;crlt=qYZD'acOrV;stc=1;chaa=1;sttr=271;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v97.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

cafe /

Resource Hash

41a3c5c810c97e53b27e6a33fff197bfe2d66238e6e5d8cc3ba1f222f346eb7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31926
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 7317 4 KB
728 B 165ms
164ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 12:53:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Oct 2023 14:48:17 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 7317 4 KB
751 B 164ms
164ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 14:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 12:54:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Oct 2023 14:48:17 GMT

GET
H3 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7317 35 KB
14 KB 161ms
161ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/m_js_controller_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65ba2edc4517131a88b842e0c3adcd034ab50ebfdcd9c31554a25b075942b1bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12623
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14041
x-xss-protection: 0
server: cafe
etag: 12153372478858386210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:17:54 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 7317 24 KB
6 KB 163ms
162ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sat, 14 Oct 2023 11:15:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 185579
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 13 Oct 2024 11:15:18 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7317 187 KB
59 KB 163ms
163ms Script
text/javascript 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 14:48:17 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 7317 23 KB
9 KB 168ms
168ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:09:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13099
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9145
x-xss-protection: 0
server: cafe
etag: 13066256994748809036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:09:58 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7317 3 KB
1 KB 169ms
169ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9659
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7317 20 KB
8 KB 165ms
165ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:26:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1317
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 14:26:20 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7317 0
0 179ms
179ms Image
text/html 2607:f8b0:4004:c06::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSARCjfQSpdxNaZal9lRCni9l_fzgouRowtDjzaDORG_SS0JsS-JZ5NWigZktqjzgPJEN449LCi5jqPq2unmiFAWiPqcg
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::63 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABB2 0
22 B 220ms
220ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7932115460707&version=m202309260101&ct=76&x=38&cor=2420274292756573700

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C8D7 42 B
64 B 224ms
224ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssync8pU6dZRaWi327Z5SETpQHTbsClW2Fb2cL9nkTTV5GvGxIVujuAcHL83Qlvr-OmbAAO9mLP98PMWjxq867LWZK7vVfFm4ino8jMhOWNXmPL4Ad3VbC-9rmEW95Q&sig=Cg0ArKJSzFbwqANe22HREAE&id=lidar2&mcvt=1045&p=1110,418,1204,1146&mtos=0,1045,1045,1045,1045&tos=0,1045,0,0,0&v=20231011&bin=7&avms=nio&bs=1600,1200&mc=0.96&vu=1&app=0&itpl=19&adk=1011857618&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467694772&rpt=1759&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK / Show response
b1t-chidc2.zemanta.com/t/imp/view/WCATURALKL33IBVG5JQG2O2VZG5KLONGJN65GERVCDD72EUZNTAV6H24STFJ4PSRUUI2LF5M5CSS42BZWKULJUGKT27TDUJXABZB4PWHVGZP3VQN6UENNCLMJRYYHOQTZQ5MW4S6X7SNIBAIX56NNXVTSZ6HOVWAHYF... Frame 48F9 26 B
270 B 49ms
48ms Fetch
image/gif 50.31.142.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://b1t-chidc2.zemanta.com/t/imp/view/WCATURALKL33IBVG5JQG2O2VZG5KLONGJN65GERVCDD72EUZNTAV6H24STFJ4PSRUUI2LF5M5CSS42BZWKULJUGKT27TDUJXABZB4PWHVGZP3VQN6UENNCLMJRYYHOQTZQ5MW4S6X7SNIBAIX56NNXVTSZ6HOVWAHYFITV2WSIQBP7YSAZWRIPQ36X5CCE4XH6KQLJWQAW32HZ46RTCJOKZ7XQFVVIJAWRMILQDPXU4SRFN2HWB37Q73TAR3JWV4YNXUTZDTLT5LQURGMS64KQGMYCQMACWNNKDNNFMFP4GNKCAY4E2MYGYLNB6EZYEZR4EGDSYYUGPP7YP763CO2C36O6C2WNBWDSAXVMABDOC4SGDQTLVQ/?
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/n2d/widget/widget.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.127 Hickory Hills, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
Date: Mon, 16 Oct 2023 14:48:18 GMT
Access-Control-Allow-Credentials: true
Content-Length: 26
Content-Type: image/gif

OPTIONS
H/1.1 204
No Content /
b1t-chidc2.zemanta.com/t/imp/view/WCATURALKL33IBVG5JQG2O2VZG5KLONGJN65GERVCDD72EUZNTAV6H24STFJ4PSRUUI2LF5M5CSS42BZWKULJUGKT27TDUJXABZB4PWHVGZP3VQN6UENNCLMJRYYHOQTZQ5MW4S6X7SNIBAIX56NNXVTSZ6HOVWAHYF... Frame 0
0 489ms
55ms Preflight 50.31.142.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://b1t-chidc2.zemanta.com/t/imp/view/WCATURALKL33IBVG5JQG2O2VZG5KLONGJN65GERVCDD72EUZNTAV6H24STFJ4PSRUUI2LF5M5CSS42BZWKULJUGKT27TDUJXABZB4PWHVGZP3VQN6UENNCLMJRYYHOQTZQ5MW4S6X7SNIBAIX56NNXVTSZ6HOVWAHYFITV2WSIQBP7YSAZWRIPQ36X5CCE4XH6KQLJWQAW32HZ46RTCJOKZ7XQFVVIJAWRMILQDPXU4SRFN2HWB37Q73TAR3JWV4YNXUTZDTLT5LQURGMS64KQGMYCQMACWNNKDNNFMFP4GNKCAY4E2MYGYLNB6EZYEZR4EGDSYYUGPP7YP763CO2C36O6C2WNBWDSAXVMABDOC4SGDQTLVQ/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.127 Hickory Hills, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: HEAD, GET, OPTIONS
Access-Control-Allow-Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
Access-Control-Max-Age: 600
Date: Mon, 16 Oct 2023 14:48:18 GMT

GET
H/1.1 200
OK / Show response
b1t-nydc1.zemanta.com/t/imp/view/WCATURALKL33IX6FV3YUVXFCCS5KLONGJN65GEWTB6O4BGCZRDOQ7GH3VRQ4K2B6UGPHXDUF223K7VXATFQQJQKAEJUFGUOTRIOICUFRGE5ZL62HEI57NAYSOXBUU356RCBHAINB3R6TKBAIX56NNXVTSZ6HOVWAHYFI... Frame C81C 26 B
270 B 69ms
68ms Fetch
image/gif 70.42.32.95
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://b1t-nydc1.zemanta.com/t/imp/view/WCATURALKL33IX6FV3YUVXFCCS5KLONGJN65GEWTB6O4BGCZRDOQ7GH3VRQ4K2B6UGPHXDUF223K7VXATFQQJQKAEJUFGUOTRIOICUFRGE5ZL62HEI57NAYSOXBUU356RCBHAINB3R6TKBAIX56NNXVTSZ6HOVWAHYFITV2WSIQBP7YSAZWRIPQ36X5CCE4XH6KQLJWQAW32HZ46RTCJOKZ7XQFVVIJAWRMILQDPXU4SRFN2HWB37Q73TAR3JWV4YNXUTZDTLT5LQURGMS64KQGMYCQMACWNNKDNNFMFP4GNKCAY4E2NR4SLY7JTZE6WR4EGDSYYUGPP7YP763CO2C36O6C2WNBWDSAXVMABDOC4SGDQTLVQ/?
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/n2d/widget/widget.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.95 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
Date: Mon, 16 Oct 2023 14:48:18 GMT
Access-Control-Allow-Credentials: true
Content-Length: 26
Content-Type: image/gif

OPTIONS
H/1.1 204
No Content /
b1t-nydc1.zemanta.com/t/imp/view/WCATURALKL33IX6FV3YUVXFCCS5KLONGJN65GEWTB6O4BGCZRDOQ7GH3VRQ4K2B6UGPHXDUF223K7VXATFQQJQKAEJUFGUOTRIOICUFRGE5ZL62HEI57NAYSOXBUU356RCBHAINB3R6TKBAIX56NNXVTSZ6HOVWAHYFI... Frame 0
0 524ms
73ms Preflight 70.42.32.95
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://b1t-nydc1.zemanta.com/t/imp/view/WCATURALKL33IX6FV3YUVXFCCS5KLONGJN65GEWTB6O4BGCZRDOQ7GH3VRQ4K2B6UGPHXDUF223K7VXATFQQJQKAEJUFGUOTRIOICUFRGE5ZL62HEI57NAYSOXBUU356RCBHAINB3R6TKBAIX56NNXVTSZ6HOVWAHYFITV2WSIQBP7YSAZWRIPQ36X5CCE4XH6KQLJWQAW32HZ46RTCJOKZ7XQFVVIJAWRMILQDPXU4SRFN2HWB37Q73TAR3JWV4YNXUTZDTLT5LQURGMS64KQGMYCQMACWNNKDNNFMFP4GNKCAY4E2NR4SLY7JTZE6WR4EGDSYYUGPP7YP763CO2C36O6C2WNBWDSAXVMABDOC4SGDQTLVQ/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.95 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: HEAD, GET, OPTIONS
Access-Control-Allow-Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
Access-Control-Max-Age: 600
Date: Mon, 16 Oct 2023 14:48:18 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C81C 0
0 254ms
252ms Image
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C36eIME0tZY4Nx8jPBZSNg5gL16ycgm7K6vy8_RDAjbcBEAEgAGB9ggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDjIAQngAgCoAwHIAwKqBOYBT9CfiG9UhvehqLedYyEujppwVAi8xu1BozInTm9l6C6C_dq2DY46h0v58kngchEynoI9urlHph7U1QQz3hKkhyzs-uYv0KqozGvng9IfyvhihWcPCvE71o73M8qxrGRCb-yLeGagxbfkZUJ_jD-uOE3gKfTjgQyrP60yorJlMAWEBQI1f3PuH0nenYMQustovT8U3ITPNeKJGI-YTbJWCin2BRz-gaz-by8bG_ZcJS5qTlWciYogYpsFpkhBB4_ISf3Yzc_SrVNxY3Z4YRLLXnnCxwflp5E7kdrJhycerDUrvvZr9hXgBAGABrjsjLadn7nj7QGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi05MzEwMTgxNTQ0OTU4MDkxgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTYzOTY4NDQ3NDI0OTcyMDgYvskH&sigh=hZyRCI5Jn1g&uach_m=[UACH]&cid=CAQSOwDICaaNrWgon2MSRBFLnWXdJZ-B8usNqLxx_VF7WFwgn_oVMornKMtCFTZXbZDPy-ygpnWVuxnGGwU1GAE&cbvp=2&vis=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H/1.1 200
OK /
b1-nydc1.zemanta.com/bidder/win/googleadx_display/09fa45fc-6c33-11ee-8073-b45f23811b26/ZS1NMAAABo4Ks-RHAADGlK0pbm1CYlkz-fecBw/GOR7RLMGXAQAHMX26C6SHZWK5EAKH4O7V7MLYYJEAW46MKLLKUDE3266LAUWZN6VHDY3BXJ... Frame C81C 0
75 B 493ms
62ms Image
text/plain 70.42.32.95
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1-nydc1.zemanta.com/bidder/win/googleadx_display/09fa45fc-6c33-11ee-8073-b45f23811b26/ZS1NMAAABo4Ks-RHAADGlK0pbm1CYlkz-fecBw/GOR7RLMGXAQAHMX26C6SHZWK5EAKH4O7V7MLYYJEAW46MKLLKUDE3266LAUWZN6VHDY3BXJL3FFSKKUJWL7QHL4KFFJULS7JY3LXEDTPX57ZBVPXOPLZO4OMPLBVH6YZRNXOEQYQSPKMDMNWVJFU2M3A4OBFYV373EYV4QQ2F4LZZPUURVFIW5XSLI3OHNSCFHECMXUDD3JHWX2KVGZ6PE4EJLY2GOPIXDTYOTJX43NECICOEKMOKYBEOLPIT33JBRXHHFXXOEKPI33BYCIXHJF5DA5R4DEVHLPDUQWSYMZXWO6R2572TKAAWX2OPUQVNGN7AZ2WYGDTUMDI3VPDLT2XOAD5PRCAONGE3D6TJNYDR2XEM7SUKR24CCJ4I4UT7Y5ZYPJC2A6UX25A5BVPSVMVX7DC2JKJ34KOGONCRXEBTNVO6OIEAYDPF3NLBTADOMYF724GDN3GMNPQLDMWEX6FKLQQRU5E2URDOHRPES6GJIKCHSJJEDODAOUN2T2TTMYZ5OY26IYA2/?&cbvp=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.95 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:18 GMT
Content-Length: 0

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame BD99 0
129 B 182ms
181ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=159463&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676953923404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8215 0
0 220ms
219ms Fetch
image/gif 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstTEpqkIXbo8-vLf9D3rkZCU1W56JoyWhHzf_ANxLWBdcMtVdf17KvWJLOv5zQ_ocLz04uSvd60rknyBZVqjuuHqfz8fiJNzB1aP79RQ_aJZXRwtqDg7IfndcBO_srus7RmNlBXDr5Y7drcKkz1JK0bLqY1Ns47nTMP2j2-dRaxi40tr3QPz_blNqUn59KNyvgNjuxyfBQA9wS-suUXJKGyOFMOyWT4fGq-Pf29pLnBG7K56Lo9DrFVgIABHx0g3DTzf5dxCbinVQsgRDB6VC_MkhqB8-3VBfoIcgZcHgZVG2MTeZUQAtNiy1syswZ458Ak340ZyOqTJO8NhjazLeuNwlKA6tDods5neVnH&sai=AMfl-YQ7jH_NWYhL78Ym1ixHv9BPC3Rgb5mMeREUGFr02Hz3rvyEFffqDTK6LkCRNls44COv9lDpgnG4YF1ygdfXLoZrQLdLvYZK4vdlAIvIlQtnMhir5t5795l2Uu34FA&sig=Cg0ArKJSzMxIM2g74xqaEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 14:48:17 GMT

GET
H3 200 TDGraphik-Semibold.woff
s0.2mdn.net/sadbundle/18330211981522502853/ Frame 9965 56 KB
56 KB 173ms
173ms Font
font/woff 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18330211981522502853/TDGraphik-Semibold.woff

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

070d1f1eb021cdbaee1d0fa530d025252b8b38211126c4a9d2775816f328e037

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:26:14 GMT
x-content-type-options: nosniff
age: 332523
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57256
x-xss-protection: 0
last-modified: Tue, 08 Aug 2023 17:04:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:26:14 GMT

GET
DATA 200
OK truncated
/ Frame 7317 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 3bd981d291bd960206547ef6288083dcec.jpg
zem.outbrainimg.com/p/srv/sha/41/e7/5f/ Frame 7317 40 KB
40 KB 165ms
165ms Image
image/jpeg 146.75.30.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zem.outbrainimg.com/p/srv/sha/41/e7/5f/3bd981d291bd960206547ef6288083dcec.jpg?w=600&h=600&fit=crop&crop=entropy&thomcrop&q=45&fm=jpg

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

146.75.30.132 Ashburn, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

b53e59144703665ee0a4d1b13fde6be9f59d88549f26c5665dda8040dba33bac

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:17 GMT
via: 1.1 varnish
x-content-type-options: nosniff
age: 2587755
x-cache: HIT, HIT, HIT
x-imgix-id: a6822defc537dce0cff3cfb6ed0bbab42e17f465
cross-origin-resource-policy: cross-origin
content-length: 40761
x-served-by: cache-sjc10030-SJC, cache-iad-kjyo7100053-IAD, cache-iad-kiad7000021-IAD
x-imgix-render-farm: 01.140360
last-modified: Sat, 16 Sep 2023 15:59:02 GMT
server: imgix
x-timer: S1697467698.789499,VS0,VE2
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 7317 15 KB
16 KB 416ms
61ms Font
font/woff2 2607:f8b0:4004:c17::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:55:32 GMT
x-content-type-options: nosniff
age: 262366
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Oct 2024 13:55:32 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 7317 16 KB
16 KB 440ms
86ms Font
font/woff2 2607:f8b0:4004:c17::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:41:32 GMT
x-content-type-options: nosniff
age: 263206
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Oct 2024 13:41:32 GMT

GET
H3 200 45445403_20230627112023448_TDI_Hierarchy_160x600_EN.png
s0.2mdn.net/ads/richmedia/studio/45445403/ Frame 9965 8 KB
8 KB 157ms
156ms Image
image/png 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45445403/45445403_20230627112023448_TDI_Hierarchy_160x600_EN.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec8149e3436dc1d5d05999727169c8d42b2fb011d64c1c42151a37332a831ac8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:44:43 GMT
x-content-type-options: nosniff
age: 72214
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8350
x-xss-protection: 0
last-modified: Tue, 27 Jun 2023 18:20:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:44:43 GMT

GET
H3 200 45445403_20230717071552936_N2B_AT_INNO_F1_160x600.jpg
s0.2mdn.net/ads/richmedia/studio/45445403/ Frame 9965 53 KB
53 KB 171ms
171ms Image
image/jpeg 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45445403/45445403_20230717071552936_N2B_AT_INNO_F1_160x600.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8723e98cabffbe97763581b597c86ffb8056ddf1c795801323d573bb1925e975

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:14:32 GMT
x-content-type-options: nosniff
age: 9225
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54537
x-xss-protection: 0
last-modified: Mon, 17 Jul 2023 14:15:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Oct 2023 12:14:32 GMT

GET
H3 200 45445403_20230630092041520_N2B_AT_INNO_F2_160x600.jpg
s0.2mdn.net/ads/richmedia/studio/45445403/ Frame 9965 40 KB
40 KB 168ms
167ms Image
image/jpeg 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45445403/45445403_20230630092041520_N2B_AT_INNO_F2_160x600.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9fea5b9e830e626523f56d876ab82a6d62796d83d1ed77d3c68476fc54894d72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18330211981522502853/index.html?e=69&leftOffset=0&topOffset=0&c=ZktibRulAM&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 12:14:32 GMT
x-content-type-options: nosniff
age: 9225
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41265
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 16:20:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Oct 2023 12:14:32 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 333C 143 B
170 B 167ms
167ms Document
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2018
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:14:39 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D570 1 KB
643 B 166ms
164ms Document
text/html 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 73191
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 18:28:26 GMT
etag: 48472445140208031
expires: Mon, 16 Oct 2023 18:28:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7317 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5455c84299f4b6c90f450fa6b3c58e6844cc9f8e0809e018e6fb83e405269698

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3942 0
22 B 199ms
198ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=749714918270&version=m202309260101&ct=76&x=38&cor=2420851283490240000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame DB8F 111 KB
39 KB 167ms
167ms Script
text/javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:22:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73532
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 16 Oct 2023 18:22:45 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame DB8F 11 KB
4 KB 163ms
163ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N636.1508339ADWORDS.COM/B30583481.375632492;dc_ver=97.287;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=3656561813;ord=6kcteq;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DCplWFME0tZQmRpKD8D9fnubgOod2f3XC4t4GfyhFkEAEg9PnGJWB9oAHqpZWiAsgBCeACAKgDAcgDAqoEhwJP0Gh8Q7tsLhftYSesU8VT9oWf4nYr0UKI4jC-dP1Evqdgl216cDwfcEYeIJxFsXULbw9uRLKb3ZnvRzs38N8ySmsUo3_hn1Xl8Z1PWA9EqUt1zr1NVZL2j_7g9SYjsTVyI5D6DPnuBD7NvRt-Q4AHvFGOF7dXhRo77Ilyz8GQYkTUhqTJBpIp57Sp-3omKxcQZrJ6Hx_UxzCTJCDFuanWBeH-EmDpwBaJgZlmS8LUPZ4d-QNfOploGaucMSldajb1tUPdbbm8m9xAE0EW3otri5ugTS-QNSrd2aRlDwgH_mPALWkPQW_gKPVrr995bDgs7bo6C3CFFbhdCkemnLJ0JnARY-pLA8AEypHs9vwD4AQBiAXJ0JHDQKAGEYAHmN7_3wGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcA0ggUCIBhEAEYHTICigI6AoBASL39wTryCBthZHgtc3Vic3luLTkzMTAxODE1NDQ5NTgwOTGACgOYCwHICwGADAHaDBEKCxCwo4nc6cH3_p0BEgIBA6oNAkNByA0B4g0TCMSrovjn-oEDFRESiAkd13MO59gTDNAVAfgWAYAXAQ%26ase%3D2%26gclid%3DEAIaIQobChMIidim-Of6gQMVERKICR3Xcw7nEAEYASAAEgKWiPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaN51DCh2ugkUDR7DccqMoeGe7lV0P-M1z2nE9eiWqrQwZc3HOe51AZnC4PlcpN_b0WNBQgsUMlGAE%26sig%3DAOD64_2mid-3_VpGTQf6lxlwMGdC53pmrw%26client%3Dca-pub-6396844742497208%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Ffinclan.com%2F$0;xdt=1;crlt=qYZD'acOrV;stc=1;chaa=1;sttr=271;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 18:10:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 18:10:23 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DB8F 41 KB
13 KB 170ms
169ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50839
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Oct 2024 00:40:58 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A5FC 1 KB
643 B 162ms
162ms Document
text/html 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 73191
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 18:28:26 GMT
etag: 48472445140208031
expires: Mon, 16 Oct 2023 18:28:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DF3C 42 B
64 B 177ms
177ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv0WA5MMmzhL0IoutG6qsFtDIReqP9JS2ozxLeanuNpjG6EnCP1uUKy5SFBH2cMlcAXpiIejTKmXunL_LB8NZz1Z_w8g3kmFyMDM7vLybPw6QQU7m3hCiA35QYeGkl2&sig=Cg0ArKJSzJ-aSoltqVSCEAE&id=lidar2&mcvt=1037&p=300,0,904,160&mtos=0,1037,1037,1037,1037&tos=0,1037,0,0,0&v=20231011&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=19&adk=2043483273&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467694724&rpt=2101&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame DB8F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceb3eb5b1b4b2449bdc43fc36fc618bb4b99dec86fb8fa11831623eaa5dcc8b6

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7317 0
0 145ms
144ms Image
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CoXaTME0tZZevHMvKzwXvg4i4DtesnIJuyur8vP0QwI23ARABIABgfYIBF2NhLXB1Yi02Mzk2ODQ0NzQyNDk3MjA4yAEJ4AIAqAMByAMCqgTiAU_Qin7HL4gySZwR3Ohq4XRcQJjuRkN0wgwGo5Wgplfq5OQgpuiIUyKlWyRBuinktHPpwGDm9suYv9o3ICgGzSMrhOyouhVxjDIBL41oP8UlIRfmv6q3NQJSe45uqwStwNwXYWiSmJ9qLvNEz5SG23MPl5sohkFSGzmr15Kul21jVoc9hcexnqqdjJXQb0-jXISKR22s02JairdjXEwb1fQPFyr1ziE9LyuMA61bUee_hkdGtI5ySQ3QkY1GC-AJTlX0BcOn-ieGyeIr6F4mJqwwJpDFX9md7fPBAc7r6AiHZkTgBAGABp_Cx-fn99imO6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTryCBthZHgtc3Vic3luLTkzMTAxODE1NDQ5NTgwOTGACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItNjM5Njg0NDc0MjQ5NzIwOBi-yQc&sigh=PE8aPpTcx7I&uach_m=[UACH]&cid=CAQSOwDICaaNphDVI6TGvXoIwUvKKKGszZr21jhRXWwo-SzYHYiS22JXxtzaIcLm4MDBvkdm2u-1uBpQc-xQGAE&cbvp=2&vis=1
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H/1.1 200
OK /
b1t-chidc2.zemanta.com/t/imp/impression/B5UAHGOLRP5NQVVXHRTQM5IOES5KLONGJN65GEWLYVZHOZPXZZTB2QPB7L7PMVEF5NC6RFPPTOEG7SYF6O7CRVXCX6HWOPOYON3EKT4KQBDYK6IVXKKVC76VUWBGFHPZ6SNIQBMBQ76LEBAIX56NNXVTSYMSN... Frame 7317 26 B
127 B 366ms
49ms Image
image/gif 50.31.142.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1t-chidc2.zemanta.com/t/imp/impression/B5UAHGOLRP5NQVVXHRTQM5IOES5KLONGJN65GEWLYVZHOZPXZZTB2QPB7L7PMVEF5NC6RFPPTOEG7SYF6O7CRVXCX6HWOPOYON3EKT4KQBDYK6IVXKKVC76VUWBGFHPZ6SNIQBMBQ76LEBAIX56NNXVTSYMSNIDWTSABYDQUHYN7L6RBCOLT7FIFU3IALN5D46PIZREXFM73YC22UEQLIWEFYBX32OJISW5D3A57YP5ZQI5U3K6MG32J4RZVZ6VYKITGJPOFIDGMBIGABLGWVBWWSWCX6DGVBAMOCNCZ3E32J6XH5R3I6CDBZMMKDHX74H77NRHNBN7HPBNLGQ3BZAL2WDS73LRDTWPBM7A/?&cbvp=2
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.127 Hickory Hills, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:18 GMT
Content-Length: 26
Content-Type: image/gif

GET
H/1.1 200
OK /
b1-chidc2.zemanta.com/bidder/win/googleadx/0a4174e9-6c33-11ee-b817-82feca6072aa/ZS1NMAAHF5cKs-VLAAIB70Y2JY8jm4zIVkJHNA/F2OSFOSVY65ZJR5KIT2VBCDZCSACGCMBB52KTHBEAW46MKLLKUDOT6VZ4GNE7BLLWQHMJHJIFLUX5V... Frame 7317 0
75 B 367ms
51ms Image
text/plain 50.31.142.127
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1-chidc2.zemanta.com/bidder/win/googleadx/0a4174e9-6c33-11ee-b817-82feca6072aa/ZS1NMAAHF5cKs-VLAAIB70Y2JY8jm4zIVkJHNA/F2OSFOSVY65ZJR5KIT2VBCDZCSACGCMBB52KTHBEAW46MKLLKUDOT6VZ4GNE7BLLWQHMJHJIFLUX5VOT4IP3ZGDFXFJULS7JY3LXEDTPX57ZBVPXOPLZO4OMPLBVH6YZG7W4SZLSPA3GLHSJSHKS4WQ4QCBFYV373EYV4QQYLWRXESHGF247HIZTPZCEZDN6DA5UVYCB2WED4MZ6RATKVE625FMSKHFGS2ZOOIPDMYZYWVSV5OX53KHTYCMHSINGL75FY4YU4SIKZXKJD3T6YA2C3RJJTBGNBA7ZC3UFHTSEDZGUOOGZRNYZ53UU6MGBWSP2UW6I3GLAWDGPVV7JQDJI36SDPD46W3WGEA77L4WHOOZEQ25PFFVG5HYBMAFEXRXGXYPSRAO6PZIMICUEKDSNKJYGFQ7EAC5WE2VTYGYZUJNXO7VKHXVV56ZM2U5BO4NKALMHVC53SCPIQHWQGIUAOWBCPMZUNES7CFI54VPEZLO5YZIBE7VZMZ2JMEQUNHR7K5UXLIQVY/?&cbvp=2
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.31.142.127 Hickory Hills, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 14:48:18 GMT
Content-Length: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7317 0
0 141ms
139ms Image
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CkeJ_ME0tZZevHMvKzwXvg4i4DtesnIJuyur8vP0QwI23ARABIABgfYIBF2NhLXB1Yi02Mzk2ODQ0NzQyNDk3MjA4yAEJ4AIAqAMBqgTiAU_Qin7HL4gySZwR3Ohq4XRcQJjuRkN0wgwGo5Wgplfq5OQgpuiIUyKlWyRBuinktHPpwGDm9suYv9o3ICgGzSMrhOyouhVxjDIBL41oP8UlIRfmv6q3NQJSe45uqwStwNwXYWiSmJ9qLvNEz5SG23MPl5sohkFSGzmr15Kul21jVoc9hcexnqqdjJXQb0-jXISKR22s02JairdjXEwb1fQPFyr1ziE9LyuMA61bUee_hkdGtI5ySQ3QkY1GC-AJTlX0BcOn-ieGyeIr6F4mJqwwJpDFX9md7fPBAc7r6AiHZkTgBAGABp_Cx-fn99imO6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTryCBthZHgtc3Vic3luLTkzMTAxODE1NDQ5NTgwOTGACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItNjM5Njg0NDc0MjQ5NzIwOBi-yQc&sigh=kcbhFFDAaLA&uach_m=[UACH]&cid=CAQSOwDICaaNphDVI6TGvXoIwUvKKKGszZr21jhRXWwo-SzYHYiS22JXxtzaIcLm4MDBvkdm2u-1uBpQc-xQGAE&vt=10&cbvp=2&vis=1
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2 204 ping
onetag-sys.com/v2/ Frame 8215 0
28 B 97ms
97ms Image
text/plain 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D570
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEGIuVOmMGdt4KYEE1ssbxwU&google_cver=1&google_push=AXcoOmRBAYAbvSu1tqI73CQwOOngiSQ_lh1CxJ2gogGQqMve8i9cTmAIVsL5ywzBf58KbVu60AcRFEG0sxrSAYRBZe...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjEwZmNhOWItZmIzZi00MDRjLWI2NmMtMzVjZTk3ZDVlZWEx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1

170 B
188 B

77ms
75ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjEwZmNhOWItZmIzZi00MDRjLWI2NmMtMzVjZTk3ZDVlZWEx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjEwZmNhOWItZmIzZi00MDRjLWI2NmMtMzVjZTk3ZDVlZWEx&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f10fca9b-fb3f-404c-b66c-35ce97d5eea1
date: Mon, 16 Oct 2023 14:48:18 GMT
server: Kestrel
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D570
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESECEsMtvYUkJtYMJmnAziyOo&google_cver=1&google_push=AXcoOmTbRU85HFlrOh3j5Qm3LXP7J0mTT1VqNNrYzQOb8IlZJcr69k04Ha-hBxTsS8afh4LdWL_Vp7_N06lcc31lMpvUfADiqfg
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MkEwREY5MTEyQ0JBODMzRQ==

170 B
188 B

80ms
80ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MkEwREY5MTEyQ0JBODMzRQ==

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MkEwREY5MTEyQ0JBODMzRQ==
date: Mon, 16 Oct 2023 14:48:18 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D570
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEAF7Eu44dILQHd6dn0MvBOM&google_cver=1&google_push=AXcoOmSVKWqVvutpQn_EJ3eaVkKYrYHIq8gNlLK2hBXSV0AIl5soJSwz_lhSJf-WGC5dpmfL44MtSqQObTacmnC...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=FXaDR_kJXJ5EqdAa_VEV20YcYY4&google_push=AXcoOmSVKWqVvutpQn_EJ3eaVkKYrYHIq8gNlLK2hBXSV0AIl5soJSwz_lhSJf-WGC5dpmfL44MtSqQObTacmn...

170 B
188 B

80ms
78ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=FXaDR_kJXJ5EqdAa_VEV20YcYY4&google_push=AXcoOmSVKWqVvutpQn_EJ3eaVkKYrYHIq8gNlLK2hBXSV0AIl5soJSwz_lhSJf-WGC5dpmfL44MtSqQObTacmnCMylmDFcsNhw

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=FXaDR_kJXJ5EqdAa_VEV20YcYY4&google_push=AXcoOmSVKWqVvutpQn_EJ3eaVkKYrYHIq8gNlLK2hBXSV0AIl5soJSwz_lhSJf-WGC5dpmfL44MtSqQObTacmnCMylmDFcsNhw
Date: Mon, 16 Oct 2023 14:48:18 GMT
Connection: keep-alive
Content-Length: 240
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D570
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPhtjjlbtweeiAlXMvzfwRY&google_cver=1&google_push=AXcoOmQmn71nwY72D58aSKvF5jtNwIrPrt4ITAgf1JPPrORrTEiMUe0XOSjM6Nck22EhLKTAQwamcm2su4NXxJZoK...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmQmn71nwY72D58aSKvF5jtNwIrPrt4ITAgf1JPPrORrTEiMUe0XOSjM6Nck22EhLKTAQwamcm2su4NXxJZoKfyY66XKfDY&google_hm=Hfv4fLZHqH1XBF01QoauFBC6

170 B
188 B

80ms
79ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmQmn71nwY72D58aSKvF5jtNwIrPrt4ITAgf1JPPrORrTEiMUe0XOSjM6Nck22EhLKTAQwamcm2su4NXxJZoKfyY66XKfDY&google_hm=Hfv4fLZHqH1XBF01QoauFBC6

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 16 Oct 2023 14:48:18 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmQmn71nwY72D58aSKvF5jtNwIrPrt4ITAgf1JPPrORrTEiMUe0XOSjM6Nck22EhLKTAQwamcm2su4NXxJZoKfyY66XKfDY&google_hm=Hfv4fLZHqH1XBF01QoauFBC6
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D570
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESEOQR-VflPbjep7LxvTdVtc0&google_cver=1&google_push=AXcoOmR8_WsJYycSiZbVFBn7nozGJVSKvsoF0JEsK-Lup92qAODUdt8Y020vZyNSY-UmTQtg6QF_y...
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmR8_WsJYycSiZbVFBn7nozGJVSKvsoF0JEsK-Lup92qAODUdt8Y020vZyNSY-UmTQtg6QF_yjOTK7cGq7vC33pNdYsHdPc&google_hm=WlMxTk1zQ281...

170 B
188 B

74ms
73ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmR8_WsJYycSiZbVFBn7nozGJVSKvsoF0JEsK-Lup92qAODUdt8Y020vZyNSY-UmTQtg6QF_yjOTK7cGq7vC33pNdYsHdPc&google_hm=WlMxTk1zQ281czRBQU9KeHdqc0FBQUFB

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Mon, 16 Oct 2023 14:48:18 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=google_ebda&google_gid=CAESEOQR-VflPbjep7LxvTdVtc0&google_cver=1&google_push=AXcoOmR8_WsJYycSiZbVFBn7nozGJVSKvsoF0JEsK-Lup92qAODUdt8Y020vZyNSY-UmTQtg6QF_yjOTK7cGq7vC33pNdYsHdPc","cluster_id":0,"gdpr":false,"ipv4":"70.28.97.142","key":"ZS1NMsCo5s4AAOJxwjsAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad63"}
X-SO-Key: ZS1NMsCo5s4AAOJxwjsAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad63
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmR8_WsJYycSiZbVFBn7nozGJVSKvsoF0JEsK-Lup92qAODUdt8Y020vZyNSY-UmTQtg6QF_yjOTK7cGq7vC33pNdYsHdPc&google_hm=WlMxTk1zQ281czRBQU9KeHdqc0FBQUFB
Cache-Control: private
X-SO-HostName: m-ad63.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 2
Content-Length: 0
X-SO-LB-Hostname: a-tgng40010.dc2p.scaleout.jp
X-SO-IP: 70.28.97.142

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D570
Redirect Chain

https://im.bluevoox.com/pixel?s1=2&s2=203601&s3=m52eksbsgbowze8o&cm=1&rd=1&google_gid=CAESEI_h8Vo-xEejaJsxLv0t7tc&google_cver=1&google_push=AXcoOmSJkcTSqWVt8zrN4227hJXPZbV-pKGb0ebEVunztde6qiqwjuHPL...
https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AXcoOmSJkcTSqWVt8zrN4227hJXPZbV-pKGb0ebEVunztde6qiqwjuHPLrBuJGlvi9vKTrP4KrijHu45hAKpJTYsj53WHIBGy2I0&google_hm=QlMuYzY0ZS1hYmIyLT...

170 B
188 B

81ms
80ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AXcoOmSJkcTSqWVt8zrN4227hJXPZbV-pKGb0ebEVunztde6qiqwjuHPLrBuJGlvi9vKTrP4KrijHu45hAKpJTYsj53WHIBGy2I0&google_hm=QlMuYzY0ZS1hYmIyLTQ5NzktODAxNg==

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AXcoOmSJkcTSqWVt8zrN4227hJXPZbV-pKGb0ebEVunztde6qiqwjuHPLrBuJGlvi9vKTrP4KrijHu45hAKpJTYsj53WHIBGy2I0&google_hm=QlMuYzY0ZS1hYmIyLTQ5NzktODAxNg==
Date: Mon, 16 Oct 2023 14:48:18 GMT
Server: openresty
Connection: close
Content-Length: 142
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D570
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESEM8JFXkYuPegFAOMYNTiYCM&google_cver=1&google_push=AXcoOmSmqcvMu_pSCrngT6BAmFqALZJHGNm-BjszxuaFZSiHdrpu4YNrqqXYCiVycIFsdZJWNcKE...
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=AWzChTa5RCaKCU1547Urpg==&no_redirect=1&google_push=AXcoOmSmqcvMu_pSCrngT6BAmFqALZJHGNm-BjszxuaFZSiHdrpu4Y...

170 B
188 B

78ms
78ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=AWzChTa5RCaKCU1547Urpg==&no_redirect=1&google_push=AXcoOmSmqcvMu_pSCrngT6BAmFqALZJHGNm-BjszxuaFZSiHdrpu4YNrqqXYCiVycIFsdZJWNcKE2B0ozXVNNrnkm2fOlxscJmbY

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=AWzChTa5RCaKCU1547Urpg==&no_redirect=1&google_push=AXcoOmSmqcvMu_pSCrngT6BAmFqALZJHGNm-BjszxuaFZSiHdrpu4YNrqqXYCiVycIFsdZJWNcKE2B0ozXVNNrnkm2fOlxscJmbY
date: Mon, 16 Oct 2023 14:48:18 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D570 0
12 B 79ms
78ms Image
text/html 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LQyU8vDeeFP-BPtDIJAL_yPr47pmZB-uNJow9-uujdbbl7tprHt4A0C9r_6Y9mQ8gx4mEhsc0

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 333C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
22 B

96ms
96ms

Document
text/html

2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:18 GMT
expires: Mon, 16 Oct 2023 14:48:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 14:48:18 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame A5FC
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1&google_push=AXcoOmT99Qeziocc8MCnOhtlI05d_b2I13x9-fLz84Zdv07rvESMoafleO7eyXeh2QtVswbXamVs5_M4rZYReh75Q1aJqtVH0w
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQwODg3ODg5MjM5OTQwNDE0NQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1

43 B
398 B

96ms
96ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1
Requested by: Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEPTUzGTukDUcuaQyh0bwjqY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5FC
Redirect Chain

https://aep.mxptint.net/sn.ashx?google_gid=CAESEBlt3P7cdGtjwu1uX0izonI&google_cver=1&google_push=AXcoOmQac57bLrXCfbb3XbNHT4oYMBshnGtVZC5SPtxntTusm3TxxT5nXKElI0lxUN0eIEj0SKarHPxOe4gPYQ8gyNgAMP4gGfM
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmQac57bLrXCfbb3XbNHT4oYMBshnGtVZC5SPtxntTusm3TxxT5nXKElI0lxUN0eIEj0SKarHPxOe4gPYQ8gyNgAMP4gGfM&google_hm=UjMzNjQ1XzEwQUE1N...

170 B
188 B

88ms
88ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmQac57bLrXCfbb3XbNHT4oYMBshnGtVZC5SPtxntTusm3TxxT5nXKElI0lxUN0eIEj0SKarHPxOe4gPYQ8gyNgAMP4gGfM&google_hm=UjMzNjQ1XzEwQUE1NDkxRl80Qjk0OUI3Qw%3D%3D

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmQac57bLrXCfbb3XbNHT4oYMBshnGtVZC5SPtxntTusm3TxxT5nXKElI0lxUN0eIEj0SKarHPxOe4gPYQ8gyNgAMP4gGfM&google_hm=UjMzNjQ1XzEwQUE1NDkxRl80Qjk0OUI3Qw%3D%3D
Date: Mon, 16 Oct 2023 14:48:17 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-380472498; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 345
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5FC
Redirect Chain

https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESED6lGnxbf8BLkK00sFR8YZI&google_cver=1&google_push=AXcoOmRTP2BKfxpZR1tvt7N3W9PCFxVXvYUJw5cdMS6vm4bBNJ7g2RDESjmXlhMqIv_yP0-PttjbJIGcFWqlfy5mJBfUH...
https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=CF6MU2wzEe6xGhJtpCvJYw&google_push=AXcoOmRTP2BKfxpZR1tvt7N3W9PCFxVXvYUJw5cdMS6vm4bBNJ7g2RDESjmXlhMqIv_yP0-PttjbJIGcFWqlfy5mJBfUH62...

170 B
188 B

129ms
129ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=CF6MU2wzEe6xGhJtpCvJYw&google_push=AXcoOmRTP2BKfxpZR1tvt7N3W9PCFxVXvYUJw5cdMS6vm4bBNJ7g2RDESjmXlhMqIv_yP0-PttjbJIGcFWqlfy5mJBfUH62OZ_4&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=adtheorent&google_hm=CF6MU2wzEe6xGhJtpCvJYw&google_push=AXcoOmRTP2BKfxpZR1tvt7N3W9PCFxVXvYUJw5cdMS6vm4bBNJ7g2RDESjmXlhMqIv_yP0-PttjbJIGcFWqlfy5mJBfUH62OZ_4&google_redir=https%3A%2F%2Frtb.adentifi.com%2FCookieSyncAdXCheck&google_ula=6802874232
date: Mon, 16 Oct 2023 14:48:18 GMT
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5FC
Redirect Chain

https://ums.acuityplatform.com/tum?umid=4&uid=CAESEBJg6PQvmIsSypBP45p6AAc&google_cver=1&google_push=AXcoOmQE5Sbsc_G78Z1e9cf0-sDQFpNBCZkLugEXqCJ32Pe4gKFWs9U2ClM3I8OiKTReJiNUAm6wENtwyGZec5uzpJSXz2cDKu8
https://cm.g.doubleclick.net/pixel?google_nid=acuity&google_hm=841202408762&us_privacy=1---

170 B
188 B

77ms
77ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=acuity&google_hm=841202408762&us_privacy=1---

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=acuity&google_hm=841202408762&us_privacy=1---
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5FC
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESELFiSf165DNnfB6BFxDNtZk&google_cver=1&google_push=AXcoOmTaksUoFUpeL3Lt6zoNtNQ09AUEPqBQdSR0D0Ku2FsJQaVsSBINFroBtnOQj1odeM5gRbz5R0fTLZZfv66LNJ8S...
https://t.pswec.com/bsw_sync?ssp=google&bsw_user_id=a77dcf3e-0a02-43b0-ba25-509c697b290e
https://t.pswec.com/ul_cb/bsw_sync?ssp=google&bsw_user_id=a77dcf3e-0a02-43b0-ba25-509c697b290e
https://x.bidswitch.net/sync?dsp_id=2&user_id=9c1e4266-4291-4413-883f-5037aae89112&expires=3&user_group=1&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmTaksUoFUpeL3Lt6zoNtNQ09AUEPqBQdSR0D0Ku2FsJQaVsSBINFroBtnOQj1odeM5gRbz5R0fTLZZfv66LNJ8SpnqTMZo&google_hm=p33PPgoCQ7C6JVCcaXspDg==

170 B
188 B

101ms
101ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmTaksUoFUpeL3Lt6zoNtNQ09AUEPqBQdSR0D0Ku2FsJQaVsSBINFroBtnOQj1odeM5gRbz5R0fTLZZfv66LNJ8SpnqTMZo&google_hm=p33PPgoCQ7C6JVCcaXspDg==

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmTaksUoFUpeL3Lt6zoNtNQ09AUEPqBQdSR0D0Ku2FsJQaVsSBINFroBtnOQj1odeM5gRbz5R0fTLZZfv66LNJ8SpnqTMZo&google_hm=p33PPgoCQ7C6JVCcaXspDg==
Date: Mon, 16 Oct 2023 14:48:18 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5FC
Redirect Chain

https://google.partners.tremorhub.com/sync?UIDF=CAESEK220VnX6jnZbscEd0SJZlQ&google_cver=1&google_push=AXcoOmTVnzQ3xG-YPq4tG26KCzN7jYZ6wYyOLWC8DIw2xNb3R7-dU7ubHHE541VsEQnLdXofsOJ7_D39bCLqGzOPDtH7YzGgsA
https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=NGM3OGQ1ZmE2NTdmNDk2MzgwMmIwYmU2YzMwNjBmYmY%3D&UIDF=CAESEK220VnX6jnZbscEd0SJZlQ&google_cver=1&google_push=AXcoOmTVnzQ3xG-YPq4tG26KCzN7...

170 B
188 B

79ms
79ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=NGM3OGQ1ZmE2NTdmNDk2MzgwMmIwYmU2YzMwNjBmYmY%3D&UIDF=CAESEK220VnX6jnZbscEd0SJZlQ&google_cver=1&google_push=AXcoOmTVnzQ3xG-YPq4tG26KCzN7jYZ6wYyOLWC8DIw2xNb3R7-dU7ubHHE541VsEQnLdXofsOJ7_D39bCLqGzOPDtH7YzGgsA

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=NGM3OGQ1ZmE2NTdmNDk2MzgwMmIwYmU2YzMwNjBmYmY%3D&UIDF=CAESEK220VnX6jnZbscEd0SJZlQ&google_cver=1&google_push=AXcoOmTVnzQ3xG-YPq4tG26KCzN7jYZ6wYyOLWC8DIw2xNb3R7-dU7ubHHE541VsEQnLdXofsOJ7_D39bCLqGzOPDtH7YzGgsA
date: Mon, 16 Oct 2023 14:48:18 GMT
server: nginx
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5FC
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESEOQR-VflPbjep7LxvTdVtc0&google_cver=1&google_push=AXcoOmTJYuTJ8DV98-5SQ3pItdeDR6XymekjdV07pxj4ZtQpamPW5wIWtcgjhAV4l7lA2FJNqUQ28...
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmTJYuTJ8DV98-5SQ3pItdeDR6XymekjdV07pxj4ZtQpamPW5wIWtcgjhAV4l7lA2FJNqUQ28guW-E_GFpFvbAbeVwxOcw&google_hm=WlMxTk1zQ281c...

170 B
188 B

74ms
74ms

Image
image/png

142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmTJYuTJ8DV98-5SQ3pItdeDR6XymekjdV07pxj4ZtQpamPW5wIWtcgjhAV4l7lA2FJNqUQ28guW-E_GFpFvbAbeVwxOcw&google_hm=WlMxTk1zQ281cjhBQUt6OE1oa0FBQUFB

Protocol

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Mon, 16 Oct 2023 14:48:18 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=google_ebda&google_gid=CAESEOQR-VflPbjep7LxvTdVtc0&google_cver=1&google_push=AXcoOmTJYuTJ8DV98-5SQ3pItdeDR6XymekjdV07pxj4ZtQpamPW5wIWtcgjhAV4l7lA2FJNqUQ28guW-E_GFpFvbAbeVwxOcw","cluster_id":0,"gdpr":false,"ipv4":"70.28.97.142","key":"ZS1NMsCo5r8AAKz8MhkAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad1021"}
X-SO-Key: ZS1NMsCo5r8AAKz8MhkAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad1021
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmTJYuTJ8DV98-5SQ3pItdeDR6XymekjdV07pxj4ZtQpamPW5wIWtcgjhAV4l7lA2FJNqUQ28guW-E_GFpFvbAbeVwxOcw&google_hm=WlMxTk1zQ281cjhBQUt6OE1oa0FBQUFB
Cache-Control: private
X-SO-HostName: m-ad1021.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 1
Content-Length: 0
X-SO-LB-Hostname: a-tgng40001.dc2p.scaleout.jp
X-SO-IP: 70.28.97.142

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A5FC 0
12 B 73ms
70ms Image
text/html 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IbUBpOAKXoCfLRNNLbJMHfR6lmk6nnnTI7ZOPERuZzdLUP_eyn02w0hIaVlMOKMN5_Z3DI

Requested by

Host: 36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
URL: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/ Frame E65B 4 KB
2 KB 69ms
66ms Document
text/html 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b154ba7896db3f352ed4f29723283899d208f48adc0a58f3239eccd01ace6ae0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 331808
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1684
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Oct 2023 18:38:10 GMT
expires: Fri, 11 Oct 2024 18:38:10 GMT
last-modified: Tue, 12 Sep 2023 18:04:15 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DB8F 0
0 127ms
127ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZfk3rldim-qRh7r8xEjZbtDapLkFjH-TbsWS_F3CpcNTpt5_hguabvi_TQSaC6cB-fO6TPgfJteXDWMwid8MgtC8N0FVz7MiwPb_AoS-3w4E60f6S-ew_V7e_LHL8ZRnZZMPg6GV11gNeoAP2hxfMDm64vmIP0g&sai=AMfl-YQzGuiPU27m9ci8tqz35Fkw9IGLfKnO1u-S33CSWnPVv8TTMN7g-yz4WV-9XndnyDnFdqUB_9Wt_w9fEALG44l8Ge9cqnKc7JnNBg&sig=Cg0ArKJSzDrqpgeZDbkwEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=217&cbvp=1&cstd=213&cisv=r20231011.55993&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0D9E 22 KB
8 KB 64ms
63ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 184962
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 14 Oct 2023 11:25:36 GMT
expires: Sun, 13 Oct 2024 11:25:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
69 B 61ms
60ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlszMDAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:18 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:18 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
62 B 97ms
97ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDM4LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQyNjUwMTc4OTY3NTAzOTEiLCJkb21haW5faWQiOiIxNTIyNTEiLCJ1bml0IjoiZGl2LWdwdC1hZC1maW5jbGFuX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTY5NzQ2NzY4NiwiYWRfcG9zaXRpb24iOjEwMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiNzg1OTg3NzktMmE5Zi00ZTVmLTQ0ZTAtNzMzM2I0MzE4YTdhIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQzOCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0MjY1MDE3ODk2NzUwMzkxIiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tYm94LTItMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:19 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:19 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/styles/ Frame E65B 2 KB
905 B 94ms
94ms Stylesheet
text/css 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/styles/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7ff2445e7c60efa2437276d83d17b810bf3d83251cb34eec5ffdba7ee3a68d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:38:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 331808
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 868
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 18:04:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:38:10 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/scripts/ Frame E65B 1 KB
576 B 93ms
93ms Script
application/x-javascript 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/scripts/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bafe161086624965512347c012932df8b031462e6af7c849a07344d3fc1a2bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:23:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 332694
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 539
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 18:04:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:23:24 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 9090 0
128 B 69ms
69ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=159463&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3404692936510273000V10%26type%3Dpba%26refUrl%3D%26vid%3D74676955973404692936510273000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 07:45:32 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 e-zfyE2pbDTyYQrCQWWBVQC0FJ7OV3Fqk4CSA41GVMg.js Show response
pagead2.googlesyndication.com/bg/ Frame 0D9E 37 KB
14 KB 81ms
81ms Script
text/javascript 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/e-zfyE2pbDTyYQrCQWWBVQC0FJ7OV3Fqk4CSA41GVMg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7becdfc84da96c34f2610ac24165815500b4149ece57716a938092038d4654c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:25:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 332561
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14689
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:25:37 GMT

GET
H3 200 bumper-logo.svg
s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/images/ Frame E65B 4 KB
2 KB 83ms
83ms Image
image/svg+xml 2607:f8b0:4004:c07::95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/images/bumper-logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/styles/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5dd4ef3b0218cf6468076aa06ac6d62ab02f8b473cc3dc14326be028d3f93e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1628671562659120209/MARC-1439-Bumper-VIN-NoBg-300x250/styles/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:38:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 331808
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1835
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 18:04:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Oct 2024 18:38:10 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 121ms
120ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlszMDAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMDAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:19 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:19 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DB8F 0
0 133ms
132ms Fetch
image/gif 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZfk3rldim-qRh7r8xEjZbtDapLkFjH-TbsWS_F3CpcNTpt5_hguabvi_TQSaC6cB-fO6TPgfJteXDWMwid8MgtC8N0FVz7MiwPb_AoS-3w4E60f6S-ew_V7e_LHL8ZRnZZMPg6GV11gNeoAP2hxfMDm64vmIP0g&sai=AMfl-YQzGuiPU27m9ci8tqz35Fkw9IGLfKnO1u-S33CSWnPVv8TTMN7g-yz4WV-9XndnyDnFdqUB_9Wt_w9fEALG44l8Ge9cqnKc7JnNBg&sig=Cg0ArKJSzDrqpgeZDbkwEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=501&vt=11&dtpt=284&dett=3&cstd=213&cisv=r20231011.55993&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 133ms
132ms Preflight
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CUcbaME0tZQmRpKD8D9fnubgOod2f3XC4t4GfyhFkEAEg9PnGJWB9oAHqpZWiAsgBCeACAKgDAcgDAqoEhAJP0Gh8Q7tsLhftYSesU8VT9oWf4nYr0UKI4jC-dP1Evqdgl216cDwfcEYeIJxFsXULbw9uRLKb3ZnvRzs38N8ySmsUo3_hn1Xl8Z1PWA9EqUt1zr1NVZL2j_7g9SYjsTVyI5D6DPnuBD7NvRt-Q4AHvFGOF7dXhRo77Ilyz8GQYkTUhqTJBpIp57Sp-3omKxcQZrJ6Hx_UxzCTJCDFuanWBeH-EmDpwBaJgZlmS8LUPZ4d-QNfOploGaucMSldajb1tUPdbbm8m9xAE0EW3otri5ugTS-QNSrd2aRlDwhF_EJSvr7LE7gkYTWM3Bm2ERwmabMUE-F1yeqK7ISNsKr-w49ipcAEypHs9vwD4AQBiAXJ0JHDQJIFBAgEGAGSBQQIBRgEoAYRgAeY3v_fAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEPT6B9IIFAiAYRABGB0yAooCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi05MzEwMTgxNTQ0OTU4MDkxgAoDyAsB2gwRCgsQsKOJ3OnB9_6dARICAQPiDRMIxKui-Of6gQMVERKICR3Xcw7n2BMM0BUBgBcBshceChwIABIUcHViLTE5NjY3MjExOTI3MDk2MDYYvskH&sigh=axb_Rg3_8ng&uach_m=[UACH]&ase=2&nis=4&cid=CAQSOwDICaaN51DCh2ugkUDR7DccqMoeGe7lV0P-M1z2nE9eiWqrQwZc3HOe51AZnC4PlcpN_b0WNBQgsUMlGAE&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 14:48:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame DB8F 0
0 128ms
127ms Fetch
text/html 2607:f8b0:4004:c17::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: finclan.com
URL: https://finclan.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
Attribution-Reporting-Eligible: event-source
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0D9E 0
25 B 121ms
121ms Image
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BvYKnMU0tZYzDJNG5owbiq7wIAAAAADgB4AQC&bg=!gIOlg8zNAAZy-tsgUvo7ADQBe5WfOOX2DP9ExIYMU_2conDN58zVDl6Xxk9fjvwxjAAvHKgHSrpWadcYTZiWu3_jpjFIAgAAAGhSAAAABWgBBwoAJCer2--LX73pfYIXRL1eM5SiUdhOvD-reNw1pBuu_i54ICOrOJkDSeVttVi6gPj86GiEv6wdp6BRM_dFkOi8YehGn-svz_M20sH4TqVFtkFKDCBw6cbpm8SgEUGxt7BL6WGZP1OS3BjVCdayMMQszRXxhI_rvG-_TDTOIk_YbHTIxP6IArLVbFXk4TyEedoglktN9kL7J20oHLKe6bw7WCqoPNOj096cvfs551FVAOMj70_JghdgsXIRaL2TcMLmGGOzir2lDpT-8mY9rljmvmv2HxaFAV5bTIoFa8U7fjBHA7rsfxLk_7Sb7Q6ca5YH74JEAGflXA-h2eKKTCRqQoGSAaJttH6gHD_LDYFPRiHABzGsd4v4ccc5DeL2fwYu_e5UndFSEHH91YzvTjTDgYVDpomcO65QsFhixqBqHTC44dKcXCXvrlhhttwHhUPzSsIFahP1FfII1reKBQaVIYmJcjluq5So8fHO8ildYL6Ph94i-EJOxcmDEXu5X6V67xyk2pJZB5PfNWhstQ1e5jvpPiWt9kgenpGuJu2L0GnP1YGvmdf_5mAhV6dhpmIkGTZXB9tKhPtV3zUzNkFsoCK3e-heOfdoE1MqwdN7EzsPza2zGz1MnB5g05paQ01dkOeLMXu91hWMVlm_uV2zEdE9-tIld0MVvIDybhtjv6d22Vir9cCM-qCCt2LHMA3IZIS9lYkAE7e2T7ofRRx78moy0kh3o1qCSDVUGix22XV8BNLjIXIBfsVtRQob4KkOTZOF_kofNyXk_G9_h32XdjiftZ67h9U3-Ho2lDfVn77-cQ6JQw2J0P985pb_eYD9TkIOghI9dWlox1KzFWJrLEENonbiKy6aNJ4eQJSByQHht8CiosPQ-n_twx3sgAPV4NvmSAKrzFPVrNzDVsFSJdG8CqX1Rdda4bZMFl12lkxj-uElA7pjx_R0MVbTqvrYvJQvfdhIOBEoY3ihN8T3HT78C6f1aCNrppqN4G7CzJgAZeZG2xC5BfMWAVk3YHGzE8WqgqsmA4XwFnMmC2_wTKOm9o-K9cww1h9UhyLiS2vIVvaTvSGqktpYxygVqsJkOGTWrOdOQlK2tVL3rgr2PzD777TyVL5Rt8e4n3qYKlaPIl99ehO-zLlcRW0p5XG5c2k27Y1InaZJZBiVZwqO0g8

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 48F9 42 B
64 B 139ms
139ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuQkz1OhYGyooqPya1cpdOx_-Lc4qSrTqou0i1kx80uyTPqxJ08tCArh1I7Pj-cLN9-3Vr-yVDQ9BR1m71TVu8lLRiQ_9bDogbg0g5gLgTKpGscjC3erg&sig=Cg0ArKJSzLRxNqHCUAlgEAE&id=lidar2&mcvt=1000&p=230,973,480,1273&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1814209333&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467696577&rpt=1007&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame 8750 53 B
467 B 346ms
346ms Document
image/gif 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=9&vsid=3404692936510273000V10&type=pba&refUrl=&vid=74676953923404692936510273000V10&ovsid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 53
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:18 GMT
expires: Mon, 16 Oct 2023 14:48:18 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 70ms
70ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:18 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:18 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C81C 42 B
64 B 168ms
167ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssyWk_HXn0lMV8IpmRcsOTnHQu3Czy-pxvZDsx8ZLYaqPXBMcBVU5eTrRngzIm61qiti6b1S67lG6ZAbjZFYQYtWJvPVPnqE8ceER9I&sig=Cg0ArKJSzM3-U7ZYXfDFEAE&id=lidar2&mcvt=1001&p=230,326,480,626&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=414029443&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467696587&rpt=1059&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 167ms
167ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjEwMDEsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDM4LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:18 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:18 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 494A 0
25 B 152ms
152ms Ping
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2141833623878&version=m202309260101&ct=76&x=38&cor=16187705444291277000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8215 42 B
64 B 165ms
165ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss7Ma91_MMctKeY9vSq2LAwQ0JwfNnbz0jmj4bRP26nd9fhVYZDYKf127YmeNzNaK1CxTMLccSUSy7UMSDxyPrD40KpXhH-bExF2vBmrYK_zitX185g7SUIYsWN1Fi_lRxwkYldn-e7sQ&sig=Cg0ArKJSzFhk9ukoROVNEAE&id=lidar2&mcvt=1000&p=300,1440,900,1600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1968572909&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467694669&rpt=3064&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 494A 42 B
64 B 168ms
168ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssv6pRB9Uthjj0DoGD71cuCLfUnEdAtfYFGo-brwwoHsSoAcM56ztLI-cL2HD7hKQsLaCOwN5UH4FZ2I1o8GUVjRlrN784R4ezUZeVz5MXAHbo&sig=Cg0ArKJSzCcK9l_tO4g-EAE&id=lidar2&mcvt=1003&p=0,0,600,160&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20231011&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=32&adk=3478109552&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467694816&rpt=2913&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame C724 53 B
467 B 179ms
179ms Document
image/gif 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=9&vsid=3404692936510273000V10&type=pba&refUrl=&vid=74676955973404692936510273000V10&ovsid=CDEE0271-7872-47B1-8AF1-5EC67D89A9E8

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 53
content-type: image/gif
date: Mon, 16 Oct 2023 14:48:18 GMT
expires: Mon, 16 Oct 2023 14:48:18 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7317 42 B
64 B 163ms
163ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsusYdbBo50oHAvloRYE-51yajdw9VbVxYjhyT1beNrbKmJVc9k2AAhtNuEYVKty9WcCGdULl-72iv8o2_-prwnuq3VM7M_XEH5iiyC2&sig=Cg0ArKJSzJ6gEwGLZtpoEAE&id=lidar2&mcvt=1000&p=1092,566,1139,1034&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=9&adk=3394468990&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467697289&rpt=494&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 105ms
105ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM2OTE3MzE5NDc2MjIxOSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJhZF9wb3NpdGlvbiI6MTExNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ4MTc3MzU0MjAsImNyZWF0aXZlX2lkIjoxMzgyNDYxMDU4NDIsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils0NjgsNjBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzY5MTczMTk0NzYyMjE5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMTE0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDgxNzczNTQyMCwiY3JlYXRpdmVfaWQiOjEzODI0NjEwNTg0MiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzY5MTczMTk0NzYyMjE5IiwiZG9tYWluX2lkIjoiMTUyMjUxIiwidW5pdCI6ImRpdi1ncHQtYWQtZmluY2xhbl9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2OTc0Njc2ODYsImFkX3Bvc2l0aW9uIjoxMTE0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDgxNzczNTQyMCwiY3JlYXRpdmVfaWQiOjEzODI0NjEwNTg0MiwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiI3MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:18 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:18 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DB8F 42 B
64 B 158ms
158ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv8lKan7uSi0TF9HP3HsovUEl3YsOrmgnnsFYX0uDgKwGlUZtAtJ92XtA2kX1Hnms2xVVMIKGEA08iQV3ecnY-0d8MMZH1hCIT2XgHJBjvY&sig=Cg0ArKJSzNhvrSMSJ3wGEAE&id=lidar2&mcvt=1001&p=0,0,250,300&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=3656561813&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467696802&rpt=1300&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 109ms
109ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM2OTE3MzE5NDc2MjIxOSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjk3NDY3Njg2LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMTQsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiI3ODU5ODc3OS0yYTlmLTRlNWYtNDRlMC03MzMzYjQzMThhN2EiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ4MTc3MzU0MjAsImNyZWF0aXZlX2lkIjoxMzgyNDYxMDU4NDIsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:19 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:19 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DB8F 42 B
64 B 126ms
125ms Fetch
image/gif 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu1pWzPek-YF0V1HoTJ6hgDf0C1fVc-4UBOydUK1WpKXKJiusrL-EZIKwayVvbaPa1BdKp-diJIaAE8VqeMIBeQFkpj7V60HLokb3avqr5puYJjE9JZIob6ILTLqjE7ZkR49YA7zQKbGQ&sai=AMfl-YQ1bXtlLQmNl-yOihoMilh3rE_rYkXrSIu4CsPCLf9g3z4_Yjs5zFdQh2x4iD42xt00Mt9fHdhG4cE5QlSb1lgcYBf-NnCMOxyHhLykM3aFsKE8wsoBPUqIaR8&sig=Cg0ArKJSzE5JoRpm1edLEAE&cid=CAQSOwDICaaN51DCh2ugkUDR7DccqMoeGe7lV0P-M1z2nE9eiWqrQwZc3HOe51AZnC4PlcpN_b0WNBQgsUMlGAE&id=lidar2&mcvt=1001&p=230,649,480,949&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1814209332&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697467696802&rpt=1552&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://36b35517716f56bfcf0e472419bf06bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 14:48:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
finclan.com/porpoiseant/ 0
16 B 82ms
81ms Ping
text/plain 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://finclan.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDI2NTAxNzg5Njc1MDM5MSIsImRvbWFpbl9pZCI6IjE1MjI1MSIsInVuaXQiOiJkaXYtZ3B0LWFkLWZpbmNsYW5fY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2OTc0Njc2ODYsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTAwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6Ijc4NTk4Nzc5LTJhOWYtNGU1Zi00NGUwLTczMzNiNDMxOGE3YSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0MzgsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: finclan.com
URL: https://finclan.com/parsonsmaize/abilene.js?gcb=195-2&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23c:4ac0:ef0a:979:b898 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: https://finclan.com
x-middleton-display: ezp_sol
date: Mon, 16 Oct 2023 14:48:19 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 15 Oct 2023 14:48:19 GMT

POST
H/1.1 204
No Content event.png
tpsc-ue1.doubleverify.com/ Frame 30A3 0
292 B 73ms
72ms Ping
text/plain 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tpsc-ue1.doubleverify.com/event.png?impid=eda0e578d6ba446ab0ca1ce34383d28c&flavor=0&gdpr=&gdpr_consent=&pltm=1&ee_dp_btreg=539180647&ee_dp_btros_64=0&ee_dp_btros_32=0&ee_dp_asmm=1&vdur=276&eoid=21&te_exec=0&msrjs=4811&sdf=67108868&vit=2&isvelg=1&rmi=16&tltms=0&tetms=10&msltms=78&vltms=276&sei=290&vetms=155&tuviims=129&tuviems=560&engms=1&engisel=1&dvp_dtcov=4&sim=3&msrcanlm=906&msrcannum=4&ee_dp_tmads=2540&ismms=37&isumms=36&nvr=6&isgmmims=37&isgmv4mims=37&elmtp=3&isbxdms=2536&b11=2793&adhgt=600&adwdth=160&norwdth=160&norhgt=600&vsos=5&dvp_vsosnmr=16&dvp_mvpw=device-width&dvp_mvpis=1&lftb=2793&sftb=2793&msrdp=1&naral=2&vct=1&vphgt=1200&vpwdth=1600&chgt=600&cwdth=160&scrhgt=1200&scrwdth=1600&strp=100&advisonl=true&isiabvms=836&isuiabvms=836&isgmpims=36&isgmv4dpims=836&ispmxpms=836&engalms=36&dvp_hdnAd=0&dvp_dpr=1&vstsz=979&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3437&cbust=1697467699955545
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements4811.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://finclan.com
Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:19 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true, true
Connection: keep-alive
Expires: 2023-10-15T14:48:19

POST
H/1.1 204
No Content event.png
tpsc-ue1.doubleverify.com/ Frame 0BF3 0
292 B 69ms
68ms Ping
text/plain 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tpsc-ue1.doubleverify.com/event.png?impid=9f779cb5ce84453f970168cb20cb2700&flavor=0&gdpr=&gdpr_consent=&pltm=1&ee_dp_asmm=1&vdur=357&eoid=16&te_exec=0&msrjs=4811&sdf=67108868&vit=2&isvelg=1&rmi=16&tltms=0&tetms=9&msltms=150&vltms=357&sei=289&vetms=153&tuviims=234&tuviems=744&engms=1&engisel=1&dvp_dtcov=4&sim=3&msrcanlm=904&msrcannum=3&ee_dp_tmads=2636&ismms=60&isumms=59&nvr=6&isgmmims=60&isgmv4mims=60&elmtp=1&isbxdms=2560&b11=2826&adhgt=600&adwdth=160&norwdth=160&norhgt=600&vsos=5&dvp_vsosnmr=16&dvp_mvpw=device-width&dvp_mvpis=1&lftb=2826&sftb=2826&msrdp=3&naral=640&vct=1&vphgt=1200&vpwdth=1600&chgt=600&cwdth=160&scrhgt=1200&scrwdth=1600&strp=100&advisonl=true&isiabvms=967&isuiabvms=967&isgmpims=59&isgmv4dpims=967&ispmxpms=967&engalms=58&dvp_hdnAd=0&dvp_dpr=1&vstsz=982&ee_dp_cvcmeeid=1&metp=2&meeid=1&ttfurm=3535&cbust=1697467699963802
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements4811.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://finclan.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://finclan.com
Pragma: no-cache
Date: Mon, 16 Oct 2023 14:48:19 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true, true
Connection: keep-alive
Expires: 2023-10-15T14:48:19

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
291 B 99ms
98ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.12/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://finclan.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://finclan.com
Date: Mon, 16 Oct 2023 14:48:20 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81

GET
H2 204 ping
onetag-sys.com/v2/ Frame 8215 0
28 B 43ms
43ms Image
text/plain 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS